EUVD-2026-70138

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

GHSA-3GQM-FCW5-W839 NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validatenetworkurl function in nltk/pathsec.py fails open when DNS resolution returns an error. The resolvehostname helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo and returns an empty list...

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validatenetworkurl function in nltk/pathsec.py fails open when DNS resolution returns an error. The resolvehostname helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo and returns an empty list...

EUVD-2026-64334

NLTK: SSRF Fail-Open in validatenetworkurl via DNS Resolution Failure...

K000162599: NGINX ngx_http_js_module vulnerability CVE-2026-18329

Security Advisory Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An...

DEBIAN-CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

UBUNTU-CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

EUVD-2026-69892

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683

FreeIPA Web UI is affected by a client-side open redirect in reset_password.html. The file parses the url query string parameter and assigns it directly to window.location after the password-reset workflow completes, without validation or allowlisting. This allows an attacker to redirect users to...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

[SECURITY] Fedora 44 Update: openvkl-2.0.2-1.fc44

Intel Open Volume Kernel Library Open VKL is a collection of high-performan ce volume computation kernels, developed at Intel. The target users of Open VKL are graphics application engineers who want to improve the performance of the ir volume rendering applications by leveraging Open VKL=E2=80=9...

PT-2026-84818

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validate timestamp and nonce function in...

PT-2026-84817

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set course mode price at lms/djangoapps/instructor/views/instructor dashboard.py:430 is decorated only with @login required and performs no course-level permission chec...

PT-2026-84756

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a js access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker c...

CAPTCHAs in the Agentic Era: Solvers That Learn from Every Encounter

Vision-language models VLMs can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the...