CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-100184 Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...

EUVD-2026-90545

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

CVE-2026-19902

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (versions up to and including 2.8.18 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping on the {search-query} dynamic tag. The replace_ai_tags() function in...

CLEANSTART-2026-QA21098 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the cri-tools package. The net/url package does not set a limit on the number of query parameters in a query...

CLEANSTART-2026-MU09759 Cancelling a query (e

Security vulnerability affects the cri-tools package. Cancelling a query e...

CLEANSTART-2026-QL84214 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

CVE-2026-39825 affects multiple packages. ReverseProxy can forward queries containing parameters not visible to Rewrite functions. See references for individual vulnerability details...

ruby:2.5 security update

An update is available for rubygem-abrt, module.rubygem-bundler, module.rubygem-bson, ruby, rubygem-mysql2, module.rubygem-abrt, rubygem-pg, module.rubygem-mongo, module.rubygem-pg, module.rubygem-mysql2, rubygem-bson, module.ruby, rubygem-mongo, rubygem-bundler. This update affects Rocky Linux 8...

Rocky Linux 9 [CIQ] Security Update: bind9.18 / bind9.18-chroot / bind9.18-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_1670)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20251670 advisory. bind: bind9: Many records in the additional section cause CPU exhaustion CVE-2024-11187 bind: bind9: DNS-over-HTTPS implementation suffers from multiple...

Rocky Linux 10.2 [CIQ] Security Update: c-ares / c-ares-debuginfo / c-ares-debugsource / c-ares-devel (crlsa-2026_42096)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202642096 advisory. c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1783354657)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783354657 advisory. - The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger...

Rocky Linux 9 [CIQ] Security Update: aardvark-dns / aardvark-dns-debuginfo / aardvark-dns-debugsource (crlsa-2026_36318)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202636318 advisory. aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset CVE-2026-35406 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: dnsmasq / dnsmasq-utils (ALMALINUX9.6:CLSA-2026:1784640629)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784640629 advisory. - A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY repli...

PT-2026-105846

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2023_4034)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234034 advisory. c-ares: 0-byte UDP payload Denial of Service CVE-2023-32067 c-ares: Buffer Underwrite in aresinetnetpton CVE-2023-31130 c-ares: Insufficient randomness in...

PT-2026-105805

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

Rocky Linux 10.2 [CIQ] Security Update: aardvark-dns / aardvark-dns-debuginfo / aardvark-dns-debugsource (crlsa-2026_36782)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202636782 advisory. aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset CVE-2026-35406 Tenable has extracted the preceding description...

Rocky Linux 10.2 [CIQ] Security Update: ldns / ldns-debuginfo / ldns-debugsource / ldns-devel / ldns-doc / etc (crlsa-2026_49836)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649836 advisory. ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching CVE-2026-10846 Tenable has extracted the preceding description block directly...

CVE-2026-103261: Allocation of Resources Without Limits or Throttling

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS-STREAM8:CLSA-2026:1767800942)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1767800942 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query...