[SECURITY] Fedora 44 Update: nghttp2-1.68.0-5.fc44

This package contains the HTTP/2 client, server and proxy programs...

SUSE SLES12 Security Update : libssh2_org (SUSE-SU-2026:3525-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3525-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598: integer overflow...

PT-2026-69318

Name of the Vulnerable Software and Affected Versions PhialsBasement KoboldCPP-MCP-Server version 1.0.0 Description A server-side request forgery SSRF issue exists within the BaseConfigSchema component in the src/index.ts file. The flaw occurs in the makeRequest function, where manipulation of th...

GHSA-2V37-7H3G-55P8 vulnerabilities

Vulnerabilities for packages: tensorflow-gpu-jupyter, gitlab-rails-ce, nextcloud-server, keep, saf, vitess, renovate, unleash, json-server, authentik, homepage, arangodb, langfuse, jitsucom-jitsu, pelias-api, vite, gitlab-rails-ce-fips, unleash-fips, dotstatsuite-supercore, langfuse-fips, keep-fi...

CVE-2026-67213 vulnerabilities

Vulnerabilities for packages: tensorflow-gpu-jupyter, gitlab-rails-ce, nextcloud-server, keep, saf, vitess, renovate, unleash, json-server, authentik, homepage, arangodb, langfuse, jitsucom-jitsu, pelias-api, vite, gitlab-rails-ce-fips, unleash-fips, dotstatsuite-supercore, langfuse-fips, keep-fi...

GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, opensearch-dashboards, jitsucom-jitsu, redisinsight, librechat, lerna, opensearch-dashboards-fips, awx, kibana, prism, semaphore, wazuh-dashboard, kubeflow-centraldashboard, langfuse, nextcloud-server, langfuse-fips...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, opensearch-dashboards, jitsucom-jitsu, redisinsight, librechat, lerna, gitlab-rails-ce-fips, awx, kibana, opensearch-dashboards-fips, prism, semaphore, wazuh-dashboard, kubeflow-centraldashboard, gitlab-rails-ce, langfuse, nextcloud-server,...

GHSA-2V37-7H3G-55P8 vulnerabilities

Vulnerabilities for packages: renovate, langfuse, vitess, json-server, jitsucom-jitsu, saf, vite, nextcloud-server...

CVE-2026-67213 vulnerabilities

Vulnerabilities for packages: renovate, langfuse, vitess, json-server, jitsucom-jitsu, saf, vite, nextcloud-server...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: langfuse, kubeflow-centraldashboard, opensearch-dashboards, prism, jitsucom-jitsu, lerna, nextcloud-server...

GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: langfuse, kubeflow-centraldashboard, opensearch-dashboards, prism, jitsucom-jitsu, lerna, nextcloud-server...

MAL-2026-13669 Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

CVE-2026-71953 D-Link DWR-M961 Command Injection via /boafrm/formNtp

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

CVE-2026-71953

Summary: CVE-2026-71953 affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. A command injection vulnerability exists in the /boafrm/formNtp interface, where an attacker can supply a malicious value to ntpServerIp1, leading to remote command exec...

CVE-2026-67620

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620

CVE-2026-67620 affects Flowise up to version 3.1.4, where the SSRF guard in httpSecurity.ts uses a faulty DEFAULT_DENY_LIST. The list blocks the AWS/GCP/Azure/DO metadata IPs 169.254.169.254 but omits OCI 192.0.0.192 and Alibaba Cloud 100.100.100.200 (and the 100.64.0.0/10 CGNAT range). An authen...

CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

EUVD-2026-54793

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...