CVE-2026-67979

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...

libgcrypt security update

1.10.0-13 - Bump version to fix wrong build target. 1.10.0.12 - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext...

CVE-2026-69090

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...

EUVD-2026-52283

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...

CVE-2026-69090 Admidio before 5.0.11 Cross-Organization Role Modification

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...

CVE-2026-69090

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...

CVE-2026-69087 Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig

The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...

EUVD-2026-52280

The Grav form plugin getgrav/grav-plugin-form before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect accepts external URLs without origin validation. When a form blueprint...

Virtuozzo Infrastructure 7.4 Hotfix 1 (7.4.0-75)

This update provides stability fixes. Vulnerability id: VSTOR-102068, VSTOR-102069, VSTOR-138302 Creating a VM in a server group could fail with "No valid host found" because a previously canceled or failed VM remained in the server group. Vulnerability id: VSTOR-120923 VPN could stop working whe...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581

Vikunja versions 0.22.0–2.3.0 are affected by an authentication bypass in API token management caused by principal-id collision: user IDs and link-share IDs share a numeric space via a generic web.Auth.GetID() interface, enabling a link-share JWT with a numeric ID equal to a target user ID to be ...

EUVD-2026-51991

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

onyx-agent

Onyx Agent v68 Multi-LLM agent framework for security testing...

GHSA-7QF5-7PPR-87V8 Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

CVE-2026-67309

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

CVE-2026-67309

Traefik 3.7.x (>=3.7.0 and

CVE-2026-67309

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

CVE-2026-67309 Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...