CVE-2026-88937: Improper Limitation of a Pathname to a Restricted Directory

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

CVE-2026-84303 vulnerabilities

Vulnerabilities for packages: smarter-device-manager, lvm-driver, aws-otel-collector, gcp-compute-persistent-disk-csi-driver, k8ssandra-client, mcp-grafana, datadog-agent, ipfs-cluster, flyte, gitlab-pages, opentofu, kubernetes-csi-external-provisioner, blob-csi, cilium, litestream,...

DRUPAL-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a stored cross-site scripting vulnerability in the admin_page upload handler . Any logged-in user can upload HTML files to the uploads/_pages/ directory containing malicious scripts that execute in visitors' browsers when accessed, enabling persiste...

CVE-2026-87928 MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

EUVD-2026-75110

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

PT-2026-89009

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An issue exists where the system fails to verify the return value of the Storage::delete function within UploadedFilesController::destroy and ApiUploadedFilesController::destroy. This allows deletio...

PT-2026-89108

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions 0.94 through 109.6 Description A stored cross-site scripting issue exists in the admin page upload handler. This flaw allows any authenticated user to upload HTML files containing malicious scripts to the uploads/ pages/...

HTTP Request Smuggling

Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to HTTP Request Smuggling in Request.prepare, which applies a generated Content-Length header through setdefault whenever the body size is known, without checking whether the caller has already...

CVE-2026-28617

In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74016

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55256

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55256

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73994

In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28633

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73976

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28633

A persistent denial of service vulnerability exists in the VoiceInteractionManagerService.java file within the initForUserNoTracing function. The root cause is resource exhaustion , which could lead to a local denial of service. Exploitation requires no additional execution privileges and does no...

CVE-2026-28617

A vulnerability exists in the WifiNetworkSuggestionsManager.java component, leading to a possible persistent Denial of Service (DoS) due to resource exhaustion . This flaw allows for a local DoS attack without requiring additional execution privileges or user interaction. The vulnerability affect...