CVE-2026-104979: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

PT-2026-106014

Name of the Vulnerable Software and Affected Versions @insumermodel/mppx-condition-gate versions prior to 3.0.0 @insumermodel/mppx-token-gate versions prior to 1.0.4 Description These packages provide conditional free-access wrappers for mppx payment methods. The issue occurs when the software...

PT-2026-104757

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account...

PT-2026-106211

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description Logout functionality clears the browser's auth-token cookie but fails to revoke the corresponding server-side session. This allows a previously captured session token to remain valid and be used to...

CVE-2026-105690: Insufficient Session Expiration

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...

CVE-2026-102777: Server-Side Request Forgery (SSRF)

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...

CVE-2026-86671: Server-Side Request Forgery (SSRF)

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

PT-2026-106017

🚨 CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the...

CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud Foundry

Severity High CVSS score: 7.6 High CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Vendor Cloud Foundry Foundation Versions Affected Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 inclusive; CF Deployment – All versions to v60.4.0 inclusive...

PT-2026-106187

Name of the Vulnerable Software and Affected Versions Ghost versions 4.39.0 through 6.63.0 Description Staff users with permission to view staff invites can discover the secret token of pending invites. This includes invites for roles with higher privileges than the user's own, which could allow ...

Debian dla-4822 : ruby-oauth2 - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4822 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4822-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-105675: Observable Discrepancy

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...

Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

MAL-2026-17525 Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

CVE-2026-105217

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217

The Cockpit CMS (versions 2.12.0 before 2.14.1 ) is vulnerable to a flaw where it disables TLS certificate verification during the cron.php web worker restart request. This allows a man-in-the-middle attacker on the outbound path to the site_url to present a fraudulent certificate and capture the...

EUVD-2026-92120

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...