CVE-2026-110593

BottleCRM versions through 1.14.5 are vulnerable to a Server-Side Template Injection (SSTI) flaw in the send_email Celery task. The root cause is the insecure compilation of user-supplied AccountEmail message_body content using django.template.Template(). Authenticated organization members can ex...

Rocky Linux 10.2 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_80664)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable...

ALSA-2026:82919 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

RHEL 8 : environment-modules (RHSA-2026:82919)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82919 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information need...

PT-2026-114169

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate git dir in Repo. clone, which omits expand vars=False when calling Git.polish url. Attackers can craft a .gitmodules submodule name containing...

Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

CVE-2026-54454

The OpenCATS applicant tracking system is vulnerable to Authenticated Remote Code Execution (RCE) in the Import module (specifically modules/import/ImportUI.php) prior to version 0.10.0 . The root cause is that the module can preserve an uploaded file's original name and place it in a web-accessi...

CVE-2026-54454 OpenCATS: Authenticated RCE in the Import module

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessib...

CVE-2026-54454

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessib...

SUSE CVE-2026-85013

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

RLSA-2026:80664 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

environment-modules security update

An update is available for environment-modules. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The environment-modules packages provide dynamic modification of...

CVE-2026-108942

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

CVE-2026-108942 philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

EUVD-2026-98181

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

PT-2026-114006

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 10.6.19 Drupal versions prior to 11.3.19 Drupal versions prior to 11.4.10 Description A remote code execution issue exists within the Field UI module field ui in Drupal core. While the issue is not directly exploitable...

CVE-2026-108942: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function createhtmlforitem of the file modules/uiextranetworks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description result...

CVE-2026-109596 Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory,...

MGASA-2026-0486 Updated perl-DBI package fixes security vulnerabilities

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM. CVE-2026-78030 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv. CVE-2026-88815 DBI versions before 1.654 for Perl incorrectly...

CVE-2026-109339

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing...