Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix for a variable not being completed when the function returns When cmdallocindex fails, cmdworkhandler needs to complete ent-slotted before returning early. Otherwise, the task that issued the command may hang...

CVE-2026-110769 holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's...

CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...

CVE-2026-110593

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...

CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...

CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts//createmai...

PT-2026-114035

🚨 CVE-2026-110593 BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send email Celery task, which compiles the user-supplied AccountEmail message body with django.template.Template. Authenticated organization members can submit template tags through POST...

CVE-2026-110593: Improper Neutralization of Special Elements Used in a Template Engine

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the sendemail Celery task, which compiles the user-supplied AccountEmail messagebody with django.template.Template. Authenticated organization members can submit template tags through POST /api/accounts/...

PT-2026-114233

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The initial GitLab migration version probe utilizes an HTTP client that lacks a timeout and fails to attach the migration task's cancellation context. An authenticated user capable of initiatin...

CVE-2026-110213

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

CVE-2026-110213 ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

CVE-2026-110213 ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

CVE-2026-110118

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

CVE-2026-110118

WorkFlow-Engine versions through 9.6.11 are susceptible to a missing authorization vulnerability (CWE-639) within the /vue/buttonOperation endpoints. This flaw allows low-privileged authenticated users to complete or reassign workflow tasks belonging to other users by supplying a known taskId to ...

Exploit for CVE-2026-68582

CVE-2026-68582 — Vikunja Link-Share BOLA Working PoC for CV...

CVE-2026-110213: Authorization Bypass Through User-Controlled Key

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to...

VulnCheck KEV: CVE-2025-7721

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the...

Apache Airflow 3.3.2 (mask_secret()) Secrets Masker Deep-Nesting Secret Leak

Summary Apache Airflow is an open-source platform for developing, scheduling, and monitoring workflows, such as traditional time based or event-triggered batch-oriented data pipelines, machine learning, model training, and agentic or LLM-based workloads. Airflow’s extensible Python framework...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the absence of CSRF protection on state-changing endpoints when OAuth cookie-based authentication is in use. An attacker can trick an authenticated user into visiting a malicious page that issues forg...

CVE-2026-18529

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task...