CVE-2026-63445

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-59186

A flaw was found in OpenEXR, a widely used image format library. A remote attacker could exploit this by providing a specially crafted tiled EXR file. When processed on a 32-bit system, an integer overflow occurs during buffer size calculation, leading to a heap out-of-bounds write. This could...

CVE-2026-61552

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

SUSE CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

CVE-2026-81942

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-11537

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2026-11537 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2026-11537 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2026-11537

CVE-2026-11537 affects IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 . A remote attacker with adjacent network access can obtain sensitive information about the file system through the FileTransfer servlet , requiring no privileges or user interaction. The CVSS 3.1 scor...

EUVD-2026-82987

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-81942 PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-81942

The PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) contains an OS command injection vulnerability in its web server . User-supplied input is passed to system() without sufficient filtering, enabling a remote authenticated attacker to execute arbitrary commands on the underlying OS a...

CVE-2026-81942 PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-93605

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

Meta’s Copyright System Is Being Weaponized Against Albanian Protesters

After three months of daily anti-government protests—dubbed the Flamingo Revolution—the sudden mass suspension of Instagram accounts has led to fears of brigading against demonstrators...

iceoryx2 (>=0.0.4, <=0.3.0), iceoryx2-bb-lock-free (>=0.0.4, <=0.3.0) +6 more potentially affected by CVE-2026-92612 via iceoryx2-bb-container (>=0.0.3, <=0.3.0)

iceoryx2-bb-container CARGO version =0.0.3, =0.0.4, =0.0.4, =0.0.4, =0.0.3, =0.0.3, =0.0.4, =0.0.4, =0.0.4, =0.3.0 Source cves: CVE-2026-92612 Source advisory: OSV:RUSTSEC-2026-0294...

AZL-105275 CVE-2026-81627 affecting package qemu 10.1.0-1

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...