PT-2026-56705

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...

PT-2026-57032

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6 Description Bazar form-field templates fail to properly sanitize input, leading to stored Cross-Site Scripting XSS. The issue occurs because the |raw'html' or |raw filters are applied to field.label and field.hi...

GHSA-9QM4-RH6W-PQ5X DSpace: Path Traversal is possible through LDN message generation

Overview A path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an...

DSpace: Path Traversal is possible through LDN message generation

Overview A path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an...

GHSA-9X82-RM84-C6X7 DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

Overview Remote Code Execution RCE is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. This attack is relate...

DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

Overview Remote Code Execution RCE is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. This attack is relate...

Directory Traversal

Overview copier is an A library for rendering project templates. Affected versions of this package are vulnerable to Directory Traversal via the trust process. An attacker can execute arbitrary commands by supplying a template reference that textually matches a trusted prefix but includes .. path...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.

Red Hat Developer Hub 1.10.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

PT-2026-56678

Name of the Vulnerable Software and Affected Versions DSpace versions 8.0-rc1 through 8.3 DSpace versions 9.0-rc1 through 9.2 DSpace versions 10-rc1 through 10.0-rc1 Description A path traversal issue exists in the COAR Notify / LDN service. An attacker with DSpace administrator credentials can...

PT-2026-56663

Name of the Vulnerable Software and Affected Versions ECA: Event - Condition - Action versions 0.0.0 through 2.1.20 ECA: Event - Condition - Action versions 3.0.0 through 3.0.12 ECA: Event - Condition - Action versions 3.1.0 through 3.1.4 Description Improperly controlled modification of...

ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

The Events, Conditions, Actions ECA module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is...

PT-2026-56677

Name of the Vulnerable Software and Affected Versions DSpace versions 8.0-rc1 through 8.3 DSpace versions 9.0-rc1 through 9.2 DSpace version 10-rc1 Description Remote Code Execution RCE is possible via Velocity Templates used for COAR Notify/LDN messages. An attacker with DSpace administrator...

EUVD-2026-42102

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:usermetadata that is pass...

CVE-2026-48950

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

CVE-2026-48950

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

CVE-2026-48950 Joomla! Core - [20260704] - XSS in com_templates

Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...

CVE-2026-48950

CVE-2026-48950 affects Joomla! Core via the file management view in com_templates. The root cause is lack of escaping, enabling an XSS vulnerability. Multiple sources (NVD, CVE lists, and Joomla security advisory) confirm an XSS in the core component with the vulnerable entry labeled for core/com...

GO-2026-5803 Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus

Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus...

PYSEC-2026-1274 Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

Impact Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently include arbitrary files/directories outsid...

PYSEC-2026-1272 Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

Impact Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently write to arbitrary directories outside the...