EUVD-2026-88609

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243

A command injection vulnerability exists in MODSetter SurfSense up to version 2.0.3 . The flaw resides in the MCP Connector Integration component, specifically involving unknown processing of the /api/search-source/connectors/mcp/test file. This vulnerability allows for remote attacks. While the ...

CLEANSTART-2026-VL04075 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

EUVD-2026-88584

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

DEBIAN-CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

UBUNTU-CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

CVE-2026-102243: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

Amazon Linux 2 : rclone (ALAS-2026-3947)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3947 advisory. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the...

PT-2026-102941

Name of the Vulnerable Software and Affected Versions Mediawiki - Collection extension versions prior to 1.46.1 Mediawiki - Collection extension version 1.45.5 Mediawiki - Collection extension version 1.43.10 Description An open redirect issue exists in the Mediawiki - Collection extension, which...

CVE-2026-100286: Exposure of Sensitive Information to an Unauthorized Actor

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

PT-2026-102437

Name of the Vulnerable Software and Affected Versions MODSetter SurfSense versions prior to 2.0.4 Description An issue in the MCP Connector Integration component allows for remote command injection. This occurs due to improper processing of the /api/search-source/connectors/mcp/test endpoint...

Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

CVE-2026-101277: Use of Less Trusted Source

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

PT-2026-102671

Name of the Vulnerable Software and Affected Versions serialize-javascript versions 7.1.1 through 7.1.1 Description serialize-javascript converts JavaScript values into a JSON superset that includes functions and regular expressions. A flaw exists where function values are not fully protected...

CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

The vulnerability of Microsoft Visual Studio Code’s source editor, related to a flaw in its data protection mechanism, allows attackers to bypass existing security measures.

The vulnerability of Microsoft Visual Studio Code’s editor is related to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker to bypass existing security measures remotely...

PT-2026-102508

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

CVE-2026-66083: Missing Authentication for Critical Function

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

PT-2026-102641

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...