CVE-2026-91858

A flaw was found in camel-fop. When third-party XML processing libraries are present on the classpath, the component fails to properly restrict external resource resolution during document transformations. A remote attacker can exploit this flaw by submitting a crafted document containing externa...

CVE-2026-119428

A flaw was found in phpMyAdmin. This Server-Side Request Forgery SSRF vulnerability allows an unauthenticated remote attacker to trigger outbound network connections by submitting custom host and port values to the setup validation script. By inspecting the returned connection error messages, an...

CVE-2026-116686

A flaw was found in mcp. Client sessions validate server-declared schema documents using a default resolver that automatically retrieves external network and local filesystem references. A malicious server can exploit this flaw to cause a Denial of Service DoS by stalling client sessions...

Linux Distros Unpatched Vulnerability : CVE-2026-116612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect...

DEBIAN-CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

UBUNTU-CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

EUVD-2026-109997

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw exists in GStreamer Editing Services (gst-editing-services) where a GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When loaded by an editing application, media player, or file-manager thumbnailing service (via autoplugging), the pipeline is ...

PT-2026-123443

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

GStreamer processing logic error vulnerability

Versions of GStreamer Editing Services prior to 1.28.8 contain a logic error vulnerability. This vulnerability arises because GES project files can embed arbitrary GStreamer pipeline descriptions as effect definitions. During loading, there is no restriction on the elements and attributes that ca...

Security Bulletin:React Router SSR Error Handling Vulnerability in Versions 6.4.0 to 7.17.0

Summary React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor...

CVE-2026-63267

A flaw was found in LibreOffice. When loading a spreadsheet, external comma-separated values CSV data links were automatically fetched without applying standard link update controls. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted document, causin...

PT-2026-105792

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

EUVD-2026-90372

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This flaw allows an unauthenticated, remote attacker to compel the server to issue arbitrary outbound network requests and read back the responses. Such exploitation could enable the attacker ...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

USN-8848-1 python-django vulnerabilities

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LT...