GHSA-3V7F-55P6-F55P vulnerabilities

Vulnerabilities for packages: kibana, tileserver-gl-fips, drupal, langfuse, kubeflow-pipelines, gitlab-rails-ce, tileserver-gl, vitess, opensearch-dashboards, saf, langfuse-fips, emscripten, rancher-api-ui, prism, node-gyp, arangodb, argo-workflows, wazuh-dashboard-fips, actions-runner, semaphore...

GHSA-2QVQ-RJWJ-GVW9 vulnerabilities

Vulnerabilities for packages: kibana, tileserver-gl-fips, lerna, py3-jupyterlab, tensorflow-cpu-jupyter, opensearch-dashboards, wazuh-dashboard-fips, ts-patch, nextcloud-server, pelias-api, rancher-api-ui, prism, gitlab-rails-ce-fips, opensearch-dashboards-fips, wazuh-dashboard, gitlab-rails-ce,...

[SECURITY] Fedora 42 Update: dotnet8.0-8.0.125-1.fc42

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 42 Update: dotnet10.0-10.0.104-1.fc42

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 42 Update: dotnet9.0-9.0.115-1.fc42

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

SUSE CVE-2026-32606

IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physical access to the machine to access the encrypted data without requiring any interaction by the...

SUSE CVE-2026-32704

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. Thi...

SUSE CVE-2026-33313

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to...

SUSE CVE-2026-33316

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja's password reset logic allows disabled users to regain access to their accounts. The ResetPassword function sets the user's status to StatusActive after a successful password reset without...

SUSE CVE-2026-33638

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. ...

SUSE CVE-2026-33677

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the GET /api/v1/projects/:project/webhooks endpoint returns webhook BasicAuth credentials basicauthuser and basicauthpassword in plaintext to any user with read access to the project. While the existing code...

[SECURITY] Fedora 44 Update: rust-reqsign-google-3.0.0-1.fc44

Google Cloud Platform signing implementation for reqsign...

[SECURITY] Fedora 44 Update: rust-reqsign-aws-v4-3.0.0-1.fc44

AWS SigV4 signing implementation for reqsign...

[SECURITY] Fedora 44 Update: mongo-c-driver-1.30.7-2.fc44

mongo-c-driver is a client library written in C for MongoDB...

LocalGPT 代码问题漏洞

LocalGPT is a localized private document-based intelligent question-and-answer and analysis platform developed by PromptEngineer. LocalGPT has code issues and vulnerabilities; these vulnerabilities stem from incorrect operations on the doPOST function, resulting in unlimited uploads...

CVE-2026-33541

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 34, a flaw in TSPortal allowed attackers to create arbitrary user records in the database by abusing validation logic. Whil...

CVE-2026-33989 @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the @mobilenext/mobile-mcp server contains a Path Traversal vulnerability in the mobilesavescreenshot and mobilestartscreenrecording tools. The saveTo and output parameters were passed directly to...

CVE-2026-33881

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environmen...

CVE-2026-33886

Statamic is a Laravel and Git powered content management system CMS. Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their...

CVE-2026-33884

CVE-2026-33884 affects Statamic CMS (Laravel/Git-based). An authenticated Control Panel user with access to live preview could misuse a live preview token to access restricted content not intended for that token. Root cause: token-based live preview access bypasses content protection for unrelate...