GHSA-89XV-2M56-2M9X vulnerabilities

Vulnerabilities for packages: langfuse-fips, keep-fips, keep, jitsucom-jitsu, homepage, peerdb-ui, langfuse...

CVE-2026-55985: Cleartext Storage of Sensitive Information

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-61884: Missing Authentication for Critical Function

The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network acces...

PT-2026-64379

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 Description A double-free issue exists in the sftp open function within src/sftp.c. This occurs when a malicious SSH server responds to SSH FXP OPEN with SSH FXP STATUS containing FX OK, causing the response da...

CVE-2026-38764

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys...

GHSA-R7WM-3CXJ-WFF9 vulnerabilities

Vulnerabilities for packages: dependency-track, trino, apicurio-registry, keycloak, apache-nifi, gradle, infinispan, cass-config-builder, akhq, flyway, spark, druid, logstash, tez, apache-tika, opensearch, spdx-tools-java, sonarqube, strimzi-kafka-operator, wildfly, apache-nifi-registry,...

Malicious code in yuinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f439dbbb74a729ef5c43bdc62f612060dbc9e6a96b825c8305b88dd43b3172 Package [email protected] contains 3 files and produced no a static rule matches and no traced-code findings indicating exfiltration, install-time...

Malicious code in svelte-streak-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45dbfe79dd6fb079811b798a734de0a661605d420454d97a0635dbdaec621efd The package contains no static or traced indicators of exfiltration, install-time remote code execution, silent-relay, credential distribution,...

GHSA-V56Q-MH7H-F735 vulnerabilities

Vulnerabilities for packages: vitess, nextcloud-server, rancher-api-ui, argo-workflows...

GHSA-5QHF-9PHG-95M2 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...

CVE-2026-59880 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, keep-fips, keep, nextcloud-server, authentik, authentik-fips, argo-workflows, rancher-api-ui, vitess, gitlab-rails-ce-fips, arangodb...

Server-Side Request Forgery

Spring Boot Admin Server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied healthUrl and managementUrl parameters during instance registration, allowing unauthenticated attackers to force the server to send HTTP requests to...

GHSA-V396-V7Q4-X2QJ vulnerabilities

Vulnerabilities for packages: mlflow, checkov...

GHSA-956X-8GVW-WG5V vulnerabilities

Vulnerabilities for packages: mlflow, checkov...

CVE-2026-16221 vulnerabilities

Vulnerabilities for packages: tileserver-gl, langfuse, yaml-language-server, opensearch-dashboards, jupyter-base-notebook, renovate, prism, vitess, argo-workflows...

CVE-2026-52688

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation...

USN-8594-1: Linux kernel (OEM) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block...

CVE-2026-59678 portprotonqt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager

An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager. This issue affects PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe...

CVE-2026-59678

CVE-2026-59678 : An reported Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any user to mount/unmount arbitrary file systems and modify network settings via NetworkManager. Affected: PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe. Impact includes local pri...

MZ Automation libIEC61850

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions. 2. RECOMMENDED PRACTICES CISA...