CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CLEANSTART-2026-UE75885 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

CVE-2026-104059: Cross-Site Request Forgery (CSRF)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-66247: Permissive Cross-domain Policy with Untrusted Domains

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

PT-2026-103865

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

PT-2026-103830

Name of the Vulnerable Software and Affected Versions Apache Camel Quarkus versions 3.2.0 through 3.33.2 Apache Camel Quarkus versions 3.34.0 through 3.39.9 Description Improper restriction of XML External Entity XXE references in the XSLT support extension camel-quarkus-support-xalan allows an...

PT-2026-103833

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

PT-2026-103982

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc (crlsa-2026_67308)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202667308 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the CIQ securit...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782224876)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782224876 advisory. - Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue...

Rocky Linux 8 [CIQ] Security Update: nginx / nginx-all-modules / nginx-debuginfo / nginx-debugsource / etc (crlsa-2026_67315)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202667315 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the CIQ securit...

Rocky Linux 9 [CIQ] Security Update: mod_proxy_cluster / mod_proxy_cluster-debuginfo / etc (crlsa-2025_9434)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259434 advisory. modproxycluster: modproxycluster unauthorized MCMP requests CVE-2024-10306 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2023_7050)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237050 advisory. python: tarfile module directory traversal CVE-2007-4559 python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracte...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782224876)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782224876 advisory. - Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue...

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager is related to improper handling of data with encoded URLs. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and gain unauthorized access to protected information by...

AlmaLinux 9.6 [TuxCare] Security Update: yelp / yelp-devel / yelp-libs (ALMALINUX9.6:CLSA-2026:1784539549)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784539549 advisory. - A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak...

AlmaLinux 9.6 [TuxCare] Security Update: haproxy (ALMALINUX9.6:CLSA-2025:1765545936)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765545936 advisory. - Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON...

Rocky Linux 8 [CIQ] Security Update: libkcapi / libkcapi-debuginfo / libkcapi-debugsource / etc Multiple Vulnerabilities (crlsa-2026_67266)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667266 advisory. libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries CVE-2026-71225 libkcapi: Memory...

AlmaLinux 9.2 [TuxCare] Security Update: haproxy (ALMALINUX9.2:CLSA-2025:1764324159)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764324159 advisory. - Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON...

Rocky Linux 8.6 [CIQ] Security Update: python38-requests Multiple Vulnerabilities (ciqsa-2026_0219)

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260219 advisory. This advisory aggregates security fixes for the python-requests SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2015-20107, CVE-2020-10735, CVE-2021-28861,...