PT-2026-84669

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

PT-2026-84674

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

PT-2026-84667

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset...

PT-2026-84663

In Eclipse Ditto versions 1.3.0, 3.9.6, the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values e.g. header:device id resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped...

PT-2026-84660

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

PT-2026-84670

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

ALSA-2026:62407 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

PT-2026-84662

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to,...

PT-2026-84671

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

PT-2026-84706

Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst: from n/a through 2.1.2...

PT-2026-84672

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

Important: gimp:2.8 security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp: Sta...

PT-2026-84661

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

PT-2026-84653

reset password.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

PT-2026-84679

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2025-23029

CVE-2025-23029 is currently in reserved status with no public technical details about the affected product, root cause, or impact. Monitor for updates as the reserving organization publicizes the vulnerability.

PT-2026-84677

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit team permission can revoke team access without the required permissions activity check, bypassing authorization controls...

PT-2026-84675

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrie...

CVE-2024-26225

CVE-2024-26225 is currently reserved with no public technical details available in the provided documents. Monitor for future updates when the candidate is officially publicized with full disclosure.

Important: gegl04 security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...