CVE-2026-74580: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

CVE-2026-53468: Improper Neutralization of Input During Web Page Generation

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-77710: Improper Input Validation

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001484)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001484 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover reserve,releasecompressblocks w/ cprwsem lock It needs to cover...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102066)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102066 advisory. In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5crecoveryanalyzemetablock and...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102104)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102104 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfscopyroot If we find an unexpected...

CVE-2026-77775: Server-Side Request Forgery (SSRF)

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...

PT-2026-79345

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

PT-2026-79962

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validate webhook url in mlflow/utils/validation.py only for the original URL while...

PT-2026-79963

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE REQUEST HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inpu...

PT-2026-79483

Name of the Vulnerable Software and Affected Versions CrossWatch versions prior to 0.9.21 Description CrossWatch is a synchronization engine. An unauthenticated network attacker can access the 'GET /api/app-auth/status' endpoint without credentials. This endpoint returns the other sessions array,...

CVE-2026-72846

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-72846

Lightdash (open-source BI platform) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its scheduled delivery webhook handling. The sendWebhook function in both the GoogleChat and MicrosoftTeams clients calls fetch directly on user-supplied webhook URLs without applying the exis...

CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-53569

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

CVE-2026-50190

Shaarli versions prior to 0.16.3 are vulnerable to stored XSS in the permalink handler of BookmarkListController.php, where raw bookmark titles are emitted unescaped into the document . An attacker who controls a remote page's title can have it fetched verbatim when an admin bookmarks the URL, pl...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the renderobjectstructure process. An attacker can access editorial placeholder and plugin structure metadata of non-authorized objects by sending crafted requests to the structure endpoint as a low-privileged...

GHSA-3277-H8G9-QJ5F Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...