Amazon Linux 2 : environment-modules (ALAS-2026-3942)

The version of environment-modules installed on the remote host is prior to 3.2.10-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3942 advisory. modulecomgenwordsandfiles fed untrusted text module names readoff disk, LOADEDMODULES, MODULEPATH straight into compg...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

EUVD-2026-88217

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-90979 Apache Karaf: LDAP filter injection in JAAS LDAP login modules

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn drawn from the login name, the resolved user DN, and its fully qualified namespace form into administrator-configured filter templates...

CVE-2026-100750

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...

CVE-2026-100750 Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...

EUVD-2026-88107

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...

CVE-2026-100750 Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...

CVE-2026-100750

The Modules Anywhere Joomla extension (versions 1.5.0 - 9.0.5 ) contains a vulnerability allowing Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) . The issue stems from a feature that allows additional attributes on a module tag to replace arbitrary parameters of the selected mo...

CVE-2026-100909

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

Apache Karaf 4.4.11 JAAS LDAP Login Modules LDAP Filter Injection

Summary Karaf is a lightweight, powerful, and enterprise ready modulith runtime. It provides all the ecosystem and bootstrapping options you need for your applications. Description Apache Karaf's JAAS LDAP login module is affected by LDAP filter injection. The user and role LDAP search filters ar...

CVE-2026-100750: Server-Side Request Forgery (SSRF)

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...

Important: environment-modules

Issue Overview: modulecomgenwordsandfiles fed untrusted text module names read off disk, LOADEDMODULES, MODULEPATH straight into compgen -W, which performs a full unquoted-word expansion on its wordlist -- including command substitution -- as a normal, documented part of its behavior. A module...

PT-2026-99781

Name of the Vulnerable Software and Affected Versions Modules Anywhere versions 1.5.0 through 9.0.5 Description Modules Anywhere Pro allows additional attributes on a module tag to replace arbitrary parameters of the selected module, a feature enabled by default. These overrides are applied witho...

CVE-2026-100723

The vm2 library before version 3.12.2 is vulnerable to a memory disclosure and corruption issue due to a failure in applying Buffer backing-store ownership invariants for host builtin modules. When an application exposes the zlib module via NodeVM's builtin allowlist, zlib.deflateSync can return ...

CVE-2026-100692

The static site generator Hugo is vulnerable in versions after v0.123.0 and before v0.166.0 due to insufficient symlink confinement checks. A malicious theme or vendored module located in themes/ could contain a symlink at a mount root (e.g., themes/mytheme/assets -> /some/dir/outside). This a...

CVE-2026-100692: Improper Link Resolution Before File Access

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-97864

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864

A vulnerability exists in GibbonEdu Gibbon (versions up to 30.0.01 ) within the Unit Planner component. Specifically, the makeBlock function in the file modules/Planner/units_add_blockAjax.php fails to perform proper authentication when the gibbonUnitBlockID/mode argument is manipulated. This fla...