CVE-2026-19879

Undertow contains a vulnerability in the HTTP response header writing path: the writeString() method narrows 16‑bit Unicode to 8‑bit bytes when writing header values, which can truncate characters to ASCII control/symbols and cause limited integrity impact or information disclosure if input isn’t...

CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

CVE-2026-73673

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

ROOT-APP-MAVEN-CVE-2024-8184 CVE-2024-8184 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2024-8184 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-1605 CVE-2026-1605 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2026-1605 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-10051 CVE-2026-10051 in org.eclipse.jetty:jetty-server - Patched by Root

Root has patched CVE-2026-10051 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...

EUVD-2026-58623

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673 Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673 Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send ...

CVE-2026-73673

CVE-2026-73673 affects Netis NC63 router firmware V3.0.0.3327. An unauthenticated firmware update vulnerability arises from a missing authentication enforcement flaw in the Boa web server and netis.cgi dispatcher, allowing an attacker to upload unsigned images via multipart POST to /cgi-bin/uploa...

CVE-2026-72827

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

CVE-2026-72812

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all...

gnome-remote-desktop security update

An update is available for gnome-remote-desktop. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GNOME Remote Desktop is a remote desktop and screen sharing...

RLSA-2026:54512 Moderate: gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service CVE-2026-18358 For more details about the...

EUVD-2026-58641

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

CVE-2026-72827 Grav CMS before 2.0.13 Remote Code Execution via Twig

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

CVE-2026-72827

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

CVE-2026-72827

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...