ZITADEL Cross-Site Scripting Vulnerability

ZITADEL is a modern open-source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak, developed by ZITADEL in Switzerland for the era of containers and serverless architectures. Versions 4.0.0 to 4.11.1 of ZITADEL contain a cross-site scripting vulnerability. This vulnerability stems fr...

F2FS Heap Buffer Overflow DoS

The vulnerability of the f2fsdozerorange function in the fs/f2fs/file.c module of the F2FS file system support in Linux kernel involves unconstrained and unrestricted resource allocation. Exploiting this vulnerability could allow a attacker to cause service failures...

timescaledb code issue vulnerabilities

Timescaledb is an extension to the temporal database developed by Tiger Data. In versions of TimescaleDB 2.23.0 to 2.25.1, there is a code vulnerability caused by improper setting of the searchpath, which may lead to arbitrary code execution...

PT-2026-23670

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Pascal Birchler Preferred Languages allows DOM-Based XSS.This issue affects Preferred Languages: from n/a through 2.2.2...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-005905)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005905 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and...

PT-2026-23672

Name of the Vulnerable Software and Affected Versions Kings Plugins B2BKing Premium versions through 5.3.80 Description An issue exists in Kings Plugins B2BKing Premium that allows for URL redirection to an untrusted site, potentially enabling phishing attacks. The issue is an 'Open Redirect' whi...

Authlib data forgery vulnerability

Authlib is an open-source library developed by Authlib developers, designed as a ultimate Python library for building OAuth and OpenID Connect servers. Versions of Authlib from 1.6.5 to 1.6.7 had a data manipulation vulnerability. This vulnerability occurred when malicious JWTs containing alg: no...

GHSA-V2XR-WVRV-P969 RAGAS has an Arbitrary File Read vulnerability

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrievedcontexts parameter when handling multimodal inputs...

CVE-2026-22723 UAA User Token Revocation logic error

Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2025-32049: denial of service attack to websocket server bsc1240751. CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests bsc1257398. CVE-2026-1539: proxy authentication credentials leaked via the...

SUSE-SU-2026:0834-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2025-32049: denial of service attack to websocket server bsc1240751. - CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests bsc1257398. - CVE-2026-1539: proxy authentication credentials leaked via...

CVE-2026-28287

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5...

EUVD-2026-9862

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5...

CVE-2026-28135

Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through = 1.7.1052...

CVE-2026-29053 Ghost Vulnerable to Remote Code Execution via Malicious Themes

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1...

CVE-2026-1713

IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD...

Canonical Ubuntu security vulnerabilities

Canonical Ubuntu is a GNU/Linux operating system primarily for desktop applications, developed by the British company Canonical. Versions of Canonical Ubuntu from 6.8.0-56.58 to 6.8.0-84.84 contained security vulnerabilities. These vulnerabilities were due to issues with the AFUNIX garbage...

CVE-2025-45691

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from improper validation and sanitization of URLs supplied in the retrievedcontexts parameter when handling multimodal inputs...

Ragas security vulnerabilities

Ragas is an open-source toolkit developed by Vibrant Labs for optimizing and evaluating large language models. Versions of Ragas from v0.2.3 to v0.2.14 contain security vulnerabilities. These vulnerabilities stem from improper URL validation and cleaning of the retrievedcontexts parameter, which...

@agentforce/adk (>=0.9.0, <=0.12.1), @agentkit-ai/bff-hono (1.0.0) +492 more potentially affected by CVE-2026-29086 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.31 and more Source cves: CVE-2026-29086 Source advisory: OSV:GHSA-5PQ2-9X2X-5P6W...