CVE-2026-87872 Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure

A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an http...

CVE-2026-87872

A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an http...

CVE-2026-87872

A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an http...

PT-2026-89097

A flaw was found in the OCAPI modules ocapi command, ocapi info of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an...

Linux Distros Unpatched Vulnerability : CVE-2026-87872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS...

CLEANSTART-2026-BY91066 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the dynatrace-operator package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CVE-2026-86993: Missing Authorization

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...

Debian dla-4777 : ata-modules-6.1.0-52-armmp-di - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4777 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4777-1 [email protected]...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules fast-uri, postcss, axios, jsonata and body-parser...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: environment-modules: environment-modules-5.6.2-1.hum1 aarch64, x8664 environment-modules-5.6.2-1.hum1.src src...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver (CVE-2026-39244, CVE-2026-54466 and CVE-2026-54490)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver. Vulnerability Details CVEID:CVE-2026-39244 DESCRIPTION: adm-zip before 0.5.18 is...

CVE-2026-85013

creationtimestamp| type| source ---|---|--- 2026-09-07 05:41:45+00:00| seen| https://bsky.app/profile/envmodules.bsky.social/post/3muvsdeyx622g...

CVE-2026-86438: Missing Authorization

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

PT-2026-86652

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

Linux Distros Unpatched Vulnerability : CVE-2026-85013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the...

CVE-2026-83627: Improper Control of Generation of Code

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

CVE-2026-53760: Cross-Site Request Forgery (CSRF)

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21696-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: -...

CVE-2026-51974: Improper Control of Generation of Code

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...