CVE-2026-77573: Time-of-check Time-of-use (TOCTOU) Race Condition

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-57170: Improper Control of Generation of Code

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...

PT-2026-82336

Name of the Vulnerable Software and Affected Versions Zyplayer-Doc versions 1.0.0 and earlier Description An issue exists that allows Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the...

CVE-2026-52776: Incomplete List of Disallowed Inputs

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-75332

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

SSTImap 1.4

SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive penetration testing tool for SSTI detection...

PT-2026-82087

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process otp login function. This makes it possible for unauthenticated...

PT-2026-82249

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.3.0 through 1.3.6 Reactor Netty versions 1.1.0 through 1.2.18 Reactor Netty versions 1.0.52 and earlier Description The Reactor Netty WebSocket client may leak credentials during WebSocket handshake redirects to a...

Dotnetnuke < 10.3.3 Portal administrator remote code execution (GHSA-hxc3-xv8x-w2g3)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A vulnerability could allow a Portal Administrator to execute arbitrary code on the DNN server under certain deployment...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098787)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098787 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on...

Linux Distros Unpatched Vulnerability : CVE-2026-34964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for...

CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...

CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...

CVE-2026-54757

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the...

CVE-2026-54757

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the...

CVE-2026-54757

Compliance-trestle (Trestle) , a Python SDK and CLI for managing OSCAL compliance documents, is vulnerable to server-side template injection (SSTI) leading to remote code execution . The root cause is that the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as ...

CVE-2026-54757 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the...

CVE-2026-77680

libsoup contains an algorithmic complexity flaw in its HTTP Range header processing that persists after the CVE-2025-32907 fix. The root cause is that the coalescing loop in soup_message_headers_get_ranges_internal() uses g_array_remove_index() for each merged range, resulting in O(N²) work when ...

CVE-2026-77680 Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

CVE-2026-55588

ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...