Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...

CVE-2026-75101

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

EUVD-2026-84874

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

GHSA-7HVX-28GP-MF6J Unleash: CR-approval email renders user-controlled raw HTML

Summary The change-request approval HTML email template renders fields as raw HTML. User who can create a change request can inject HTML into approval notification emails. I was not able to confirm Enterprise platform is using vulnerable code nor that it doesn't sanitize input. Details...

CVE-2026-85709 LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in documentroutes.py, graphroutes.py, queryroutes.py, ollamaapi.py, and lightragserver.py. The detail=stre, detail=strexc, and equivalent...

CVE-2026-85709

The LightRAG API server (prior to version 1.5.5 ) is vulnerable to sensitive information exposure because it returns raw Python exception text in HTTP error responses. Specifically, error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py pass ...

CVE-2026-88008

A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP/2 request that includes specific upgrade headers. If the backend server accepts the upgrade, Traefik enters a raw...

CVE-2026-75101: Authorization Bypass Through User-Controlled Key

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

SUSE CVE-2026-90333

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

CVE-2026-80110

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

OESA-2026-3986 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state,...

BIT-ZOOKEEPER-2026-79993 Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

PT-2026-95786

Name of the Vulnerable Software and Affected Versions WP Composer – The Easiest Page Builder versions prior to 1.0.6 Description Stored Cross-Site Scripting occurs via the pbwp raw shortcode shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitizati...

Linux Distros Unpatched Vulnerability : CVE-2026-90333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes...

SUSE SLES12 Security Update : tiff (SUSE-SU-2026:4252-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4252-1 advisory. This update for tiff fixes the following issue: - CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw...

PT-2026-95515

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions prior to 7.2.0 Description Semantic MediaWiki is an open-source extension for MediaWiki used to store and query data. The software fails to sanitize the sep variable when it is inserted into the HTML that joins tabl...

CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

Grav: Stored XSS via Markdown audio/video media <source> URL

Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...

GHSA-6QW9-4VV5-JR97 Grav: Stored XSS via Markdown audio/video media <source> URL

Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...