Qubes OS Security in the Public Record

Qubes OS is a revealing case for security measurement because its architecture makes component boundaries security-relevant. We present a protocol-driven longitudinal analysis of 109 public Qubes Security Bulletins QSBs, 2011--2025, the official Qubes-maintained Xen Security Advisory XSA tracker,...

CVE-2026-46336: Improper Limitation of a Pathname to a Restricted Directory

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

CVE-2026-52892 Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST,...

pytorch-segmentation-models-trainer (0.7.0), ratsnlp (0.0.9993) potentially affected by CVE-2026-58659 via pytorch-lightning (1.3.7)

pytorch-lightning PYPI version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.7.0 - ratsnlp 0.0.9993 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

pytorch-segmentation-models-trainer (0.15.0) potentially affected by CVE-2026-58659 via pytorch-lightning (1.5.2)

pytorch-lightning PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.15.0 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

eargait (3.0.0), pytorch-segmentation-models-trainer (>=0.16.0, <=0.16.1) potentially affected by CVE-2026-58659 via pytorch-lightning (1.5.3)

pytorch-lightning PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - eargait 3.0.0 - pytorch-segmentation-models-trainer =0.16.0, =0.16.1 Source cves: CVE-2026-58659 Source advisory:...

pytorch-segmentation-models-trainer (0.11.0) potentially affected by CVE-2026-58659 via pytorch-lightning (1.4.3)

pytorch-lightning PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - pytorch-segmentation-models-trainer 0.11.0 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

paoding (0.1.1), pytorch-segmentation-models-trainer (0.12.0) potentially affected by CVE-2026-58659 via pytorch-lightning (1.4.8)

pytorch-lightning PYPI version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - paoding 0.1.1 - pytorch-segmentation-models-trainer 0.12.0 Source cves: CVE-2026-58659 Source advisory: OSV:PYSEC-2026-3967...

chemprobe (0.1.5), finetuning-scheduler (0.3.3) +1 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.8.4)

pytorch-lightning PYPI version 1.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - chemprobe 0.1.5 - finetuning-scheduler 0.3.3 - uncertainty-estimation-models 0.1.0 Source cves: CVE-2026-58659 Source advisory...

finetuning-scheduler (0.2.1), nlhappy (2022.9.14) +1 more potentially affected by CVE-2026-58659 via pytorch-lightning (1.7.1)

pytorch-lightning PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - finetuning-scheduler 0.2.1 - nlhappy 2022.9.14 - pytorch-segmentation-models-trainer 0.17.0 Source cves: CVE-2026-58659 Source...

CVE-2026-53447: Authorization Bypass Through User-Controlled Key

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport or checking source-board membership. Any authenticated user who kno...

CVE-2026-53446: Server-Side Request Forgery (SSRF)

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fetched by server/notifications/outgoing.js without applying the existing validateAttachmentUrl private-network checks from...

EUVD-2025-210463

A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault MNRF...

CVE-2026-62657

A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device...

CVE-2026-62655

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable...

CVE-2026-62656

The CVE-2026-62656 entry concerns post-authenticated command injection affecting certain NETGEAR RAX models. A logged-in user can send specially crafted requests to the router to run unauthorized commands, enabling changes to the router and impacting security/operation. The vulnerability targets ...

EUVD-2026-44327

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable...

CVE-2026-62655

CVE-2026-62655 describes a DoS due to a stack overflow in certain NETGEAR Orbi models. The vulnerability can cause the device to stop responding or restart, disrupting network connectivity and making the device temporarily unavailable. The provided documents do not specify affected models, firmwa...

CVE-2026-62657 Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models

A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take control of the device...

CVE-2026-62657

CVE-2026-62657 concerns a certificate validation flaw in NETGEAR XR1000 Gaming Router and certain Nighthawk models. The issue could allow an unauthenticated attacker to remotely access and take control of the device due to weaknesses in certificate validation. The sources identify affected device...