CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, kibana, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, kibana, opensearch-dashboards-fips, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, kibana, opensearch-dashboards-fips, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: librechat, kibana, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: librechat, kibana, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: librechat, kibana, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: langfuse, opensearch-dashboards, nextcloud-server...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: langfuse, opensearch-dashboards, nextcloud-server...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server...

GO-2026-5463 Bettercap has an integer coercion error in modules/mysql_server/mysql_server.go in github.com/bettercap/bettercap

Bettercap has an integer coercion error in modules/mysqlserver/mysqlserver.go in github.com/bettercap/bettercap...

GO-2026-5730 Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy...

Arbitrary Code Injection

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TwigView::render process. An attacker can execute arbitrary operating system commands by injecting malicious Twig expressions into mail...

CVE-2026-66034

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...

DEBIAN-CVE-2026-66032

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containin...

CVE-2026-65711

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via stri...

UBUNTU-CVE-2026-66034

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...

GHSA-GH7P-78X6-JW6M Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Summary The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material settings.ui.toolServers.key, which is not...