EUVD-2026-52732

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-24079

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-24079

Technical details are not publicly available in the provided documents. The available descriptions only mention a cryptographic issue during processing of registration requests with malformed or missing authentication parameters. Monitor for updates.

CLSA-2026-1781225615 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.30.0.post2+tuxcare...

CLSA-2026-1781225614 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.31.0.post2+tuxcare...

CLSA-2026-1780879897 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post2+tuxcare...

CLSA-2026-1772496680 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.31.0.post1+tuxcare...

CLSA-2026-1772496682 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.30.0.post1+tuxcare...

CLSA-2026-1772496679 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.25.1.post1+tuxcare...

CLSA-2026-1772496706 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post1+tuxcare...

X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()

A flaw was found in the X.org X11 server, specifically within the GLX OpenGL Extension to the X Window System dispatch layer. A remote attacker can exploit this vulnerability by sending a series of crafted X11 requests. This can lead to a use-after-free condition, where the server attempts to wri...

CVE-2026-69250 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

PYSEC-2026-3572 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Summary Numerous HTTP-emitting modules core.api.httpget, core.api.httppost, graphql.query/graphql.mutation, monitor.httpcheck, communication.slacksend, notification.discord,slack,teams.sendmessage, ai.visionanalyze anthropic path, verify.visualdiff, browser.proxyrotate, and the agent/llm inline...

PYSEC-2026-3586 OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...

pytonapi has a Webhook Custom Path Authentication Bypass

Webhook Custom Path Authentication Bypass in pytonapi SummaryTonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths e.g...

PYSEC-2026-3615 QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Impact The relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

PYSEC-2026-3590 Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat SummaryOpen WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Python...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses

A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak p...

CVE-2026-14838

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...