CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...

CVE-2026-55465

The Goobi viewer web application (versions 22.04 to before 26.05 ) is vulnerable to Solr injection via an unauthenticated REST endpoint: GET /api/v1/index/{solrField}/spatial/search. The root cause is the direct concatenation of the user-supplied region query parameter into a Solr query string wi...

EUVD-2026-109066

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...

CLEANSTART-2026-DA78586 flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input

Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input...

CLEANSTART-2026-GV77140 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API...

CLEANSTART-2026-NZ15191 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user...

CLEANSTART-2026-VC47751 Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker

Security vulnerability affects the sonarqube package. Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker...

CLEANSTART-2026-QV23882 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s...

CVE-2026-103009 affects multiple packages. Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. See references for individual vulnerabilit...

PT-2026-122134

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...

Automated Post-Exploitation Attack Chain Exploration Based on a Phase-Guided Hybrid Planning-Monte Carlo Tree Search Algorithm

Advanced attackers in post-exploitation scenarios increasingly craft attack chains that combine benign operations, configuration errors, and vulnerability exploitation to achieve objectives like privilege escalation. While such chains pose significant threats, manually discovering them in complex...

HP One Agent permission and access control issue vulnerability

Versions of HP One Agent prior to 1.87.4769.0 contain a privilege escalation and access control vulnerability stemming from uncontrolled search path elements, which may lead to privilege escalation and/or arbitrary code execution...

PT-2026-122218

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An issue exists in the twisted.mail.imap4.IMAP4Server where the twisted.mail.imap4.parseNestedParens function can be reached with a negative literal size during an authenticated SEARCH command...

PT-2026-122411

Summary An infinite-loop vulnerability CWE-835 in the Twisted IMAP4 server lets an authenticated client freeze the whole process with one small command. twisted.mail.imap4.parseNestedParens reads an IMAP literal size with int and never rejects a negative value. A negative size such as -100 drives...

Rocky Linux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1792746510)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792746510 advisory. - Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the...

AlmaLinux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1792746510)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792746510 advisory. - Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the...

CVE-2026-108398

A flaw was found in .NET Framework. An untrusted search path vulnerability allows an authenticated local attacker to bypass security features. By placing a malicious file in a search directory used by the application, an attacker can trick the system into loading unauthorized resources, potential...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangChain (CVE-2026-55443)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangChain, due to several LangChain components that resolve filesystem paths or expand search patterns that do not consistently confine the resolved path to the intended root directory. LangChain is used in our Spee...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-113790 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-113790 Source...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-113791 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-113791 Source...

ApostropheCMS: Unauthenticated PublicApiProjection Bypass Via Search And Sort Query Builders In The Public REST API

Summary ApostropheCMS lets a module expose an anonymous read API by setting "publicApiProjection", which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of...