CVE-2026-10031

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

CVE-2026-10031 SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attacker...

SUSE CVE-2026-49397

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services EnableShowInService: false are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version...

SUSE CVE-2026-52812

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone /// but per-repo authorization lives in the lfsobject table keyed repoid, oid. serveUpload skips re-uploading when the OID file already exists on disk and inserts a new repoid, oid r...

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Summary The HTTP modules that DO call the SSRF guard http.get, http.request, http.batch validate only the initial URL, then issue the request with aiohttp's default allowredirects=True and perform no per-hop revalidation. An attacker hosts a public URL that 302-redirects to an internal address; t...

GHSA-C9HR-64H3-GXPC Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Summary The HTTP modules that DO call the SSRF guard http.get, http.request, http.batch validate only the initial URL, then issue the request with aiohttp's default allowredirects=True and perform no per-hop revalidation. An attacker hosts a public URL that 302-redirects to an internal address; t...

GHSA-PGWH-4JJ4-QM8V Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Summary Numerous HTTP-emitting modules core.api.httpget, core.api.httppost, graphql.query/graphql.mutation, monitor.httpcheck, communication.slacksend, notification.discord,slack,teams.sendmessage, ai.visionanalyze anthropic path, verify.visualdiff, browser.proxyrotate, and the agent/llm inline...

CVE-2026-64476

A flaw was found in the Linux kernel's vfio/pci driver. The disableidled3 flag, which controls device power states, was handled as a global module parameter instead of being latched per device. This improper handling could lead to unbalanced Power Management PM operations for devices already boun...

CVE-2026-14188 Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14188

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

EUVD-2026-50981

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14188 Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14188

The CVE-2026-14188 details a vulnerability in the Easy Appointments WordPress plugin (versions up to 3.12.26) where a customer-listing handler does not perform a per-request capability check or nonce verification. This allows authenticated users with contributor-level access to read every stored ...

PT-2026-66629

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4 Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30697)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from the improper handling of initialization, transform contexts, and per-instance state by...

Security Bulletin: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...

CVE-2026-67437

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

CVE-2026-67424

Flyto2 Core exposes a Redirect/SSRF issue in HTTP modules http.get, http.request, and http.batch (files src/core/modules/atomic/http/get.py, http/request.py, http/batch.py). Prior to version 2.26.7, these modules validate only the initial URL and then follow redirects with allow_redirects=True wi...

EUVD-2026-50443

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

CVE-2026-59899 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...