CVE-2026-69219 vulnerabilities

Vulnerabilities for packages: logstash, conductor, thingsboard, conductor-fips, nuxeo, traccar-fips, zipkin, cassandra-reaper, traccar, druid, logstash-fips...

GHSA-6G32-PXV4-2WFJ vulnerabilities

Vulnerabilities for packages: logstash, conductor, thingsboard, conductor-fips, nuxeo, traccar-fips, zipkin, cassandra-reaper, traccar, druid, logstash-fips...

GHSA-PCW8-M77R-2528 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

GHSA-6G32-PXV4-2WFJ vulnerabilities

Vulnerabilities for packages: zipkin, cassandra-reaper, druid, logstash, thingsboard...

GHSA-5XWG-CFVJ-GFF5 vulnerabilities

Vulnerabilities for packages: zipkin, cassandra-reaper, druid, logstash, thingsboard...

CVE-2026-63335 vulnerabilities

Vulnerabilities for packages: zipkin, cassandra-reaper, druid, logstash, thingsboard...

CVE-2026-61634 vulnerabilities

Vulnerabilities for packages: zipkin, cassandra-reaper, druid, logstash, thingsboard...

GHSA-93J5-89VC-PPH4 vulnerabilities

Vulnerabilities for packages: zipkin, cassandra-reaper, druid, logstash, thingsboard...

GHSA-68MJ-5WR7-6FGG vulnerabilities

Vulnerabilities for packages: zipkin, cassandra-reaper, druid, logstash, thingsboard...

GHSA-PCW8-M77R-2528 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

CVE-2026-68560

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-22306

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

OpenJDK: Enhance TLS server (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle...

GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

GHSA-WF6J-GR27-G7CH GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

CVE-2026-16822

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 have improper certificate validation allowing a remote attacker (no auth needed) to impersonate the TNC policy server and modify traffic; CVSS 9.3 Critical. IBM support page linked as reference; no patch or exploit details provided in documents.

EUVD-2026-62705

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation...

EUVD-2026-62704

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

CVE-2026-68561

Wekan (open-source kanban built with Meteor) prior to 9.89 has a privilege escalation flaw in server/permissions/boards.js. The canUpdateBoardSort check authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR semantics and applies the complete mo...

CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...