CVE-2026-23829

CVE-2026-23829 — Mailpit SMTP header injection via regex bypass. Mailpit’s SMTP server (prior to v1.28.3) fails to properly filter control characters in RCPT TO/MAIL FROM addresses due to a regex with an incomplete character class, allowing CR/LF bypass and header injection. The flaw stems from G...

EUVD-2026-3162

CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a server and cause the server to crash...

CVE-2026-23722

WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting XSS vulnerability was discovered in the WeGIA system, specifically within the html/memorando/inseredespacho.php file. The application fails to properly sanitize or encode user-supplied input via t...

CVE-2026-23520

Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to r...

CVE-2026-22265

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py...

CVE-2026-23529 Arbitrary File Read in Google BigQuery Sink connector

Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file read in Google BigQuery Sink connector. Aiven's Google BigQuery Kafka Connect Sink connector requires Google Cloud credential configurations...

CVE-2026-23528

CVE-2026-23528 affects Dask distributed versions prior to 2026.1.0 when used with Jupyter Lab and jupyter-server-proxy. A cross-site scripting (XSS) vulnerability in the Dask dashboard can be triggered by a crafted URL, causing code execution in the default Jupyter Python kernel via the Jupyter L...

CVE-2026-0949

PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting XSS vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and...

CVE-2026-0695

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected...

CVE-2025-14510

Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004088)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004088 advisory. An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2usb.c driver...

CVE-2025-24531

The CVE-2025-24531 entry concerns OpenSC pam_pkcs11 before 0.6.13, where pam_sm_authenticate() may return PAM_IGNORE in various error conditions (e.g., smartcard errors before login). This behavior can allow authentication bypass. The open/public data provided identifies the affected component an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001015)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001015 advisory. A flaw was found in the hugetlbmcopyatomicpte function in mm/hugetlb.c in the Linux kernel before 4.13.12. A lack of size check could cause a denial of service BUG...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004399)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004399 advisory. A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003582)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003582 advisory. An issue was discovered in the Linux kernel before 5.0. The function mdiobusregister in drivers/net/phy/mdiobus.c calls putdevice, which will trigger a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001658)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001658 advisory. The tcpmssmanglepacket function in net/netfilter/xtTCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000890)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000890 advisory. The 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic an...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004017)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004017 advisory. Use-after-free vulnerability in fs/blockdev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging imprope...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003968)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003968 advisory. Memory leaks in clocksourcecreate functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service memory...

Kafka Connect BigQuery Connector code issues and vulnerabilities

Kafka Connect BigQuery Connector is a high-performance data synchronization middleware developed by Aiven Open. Versions of the connector prior to 2.11.0 contained code vulnerabilities. These vulnerabilities stemmed from the fact that the service did not validate the credentials from external...