CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

EUVD-2025-210735

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27621

UpTrain ≤0.7.1 ships a static default API key derived from a hardcoded username and an open CORS policy, letting any website send authenticated cross-origin requests via the uptrain-access-token header and perform privileged actions. CVSS 8.7 HIGH. No patch is available; monitor the GitHub adviso...

EUVD-2025-210733

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2026-74464

A flaw was found in the Open vSwitch OVS component of the Linux kernel. This vulnerability occurs when a packet becomes unparseable during a flow key update operation. This can lead to a memory leak, potentially allowing a remote attacker to cause a denial of service by exhausting system resource...

Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

GHSA-M44R-7C5H-M6MJ Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

CVE-2026-19968 Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow

A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces3DGSMDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer...

Important: iscsi-initiator-utils

Issue Overview: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100346)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100346 advisory. In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/setmasked payload length validateset accepted OVSKEYATTRMPLS as...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Note: This advisory is applicable to Amazon Linux 2...

PT-2026-76718

Name of the Vulnerable Software and Affected Versions Medplum versions prior to 5.1.6 Description An issue exists in the external identity provider callback at the 'GET /auth/external' endpoint. The system accepts redirect URIs that only need to start with a registered client redirect URI rather...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Issue Correction: Run dnf update isns-utils...

openSUSE 16 Security Update : open-iscsi (openSUSE-SU-2026:21580-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21580-1 advisory. Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attacke...

SUSE CVE-2026-41479

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

CVE-2026-19926

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...

CVE-2026-19926

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...

PT-2026-73072

Name of the Vulnerable Software and Affected Versions Evergreen versions prior to 3.14.12 Evergreen versions prior to 3.15.12 Evergreen versions prior to 3.16.6 Evergreen versions prior to 3.17-beta2 Description A remote SQL injection exists within the open-ils.fielder OpenSRF Service, specifical...