EUVD-2026-52976

A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/twofactorauth/views.py of the component 2FA Verify Endpoint. Such manipulation leads to improper authentication. The attack may be launched remotely. Th...

EUVD-2026-52965

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

SUSE CVE-2026-69198

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader GStreamer-SA-2026-0069: Heap buffer...

Non-constant time webhook bearer token comparison in webhook-secret-credentials-provider

webhook-secret-credentials-provider 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook bearer toke...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21520-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21520-1 advisory. - CVE-2026-45793: Github Actions issued GITHUBTOKEN disclosure in GitHub Actions logs bsc1271504. - CVE-2026-59946: path traversal in package bi...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1464:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1464:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...

CVE-2026-18816

A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/twofactorauth/views.py of the component 2FA Verify Endpoint. Such manipulation leads to improper authentication. The attack may be launched remotely. Th...

CVE-2026-70619

creationtimestamp| type| source ---|---|--- 2026-08-04 22:09:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dqncya2mxc36p 2026-08-04 23:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msc4jhvpk42n...

CVE-2026-18817

CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...

CVE-2026-18816

Summary : CVE-2026-18816 affects Baserow up to 2.3.2. The vulnerability resides in the 2FA Verify Endpoint, specifically the verify function in backend/src/baserow/api/two_factor_auth/views.py, enabling improper authentication. Impact : Could be exploited remotely; the exploit complexity is descr...

CVE-2026-18816 Baserow 2FA Verify Endpoint views.py verify improper authentication

A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/twofactorauth/views.py of the component 2FA Verify Endpoint. Such manipulation leads to improper authentication. The attack may be launched remotely. Th...

CVE-2026-65986

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type...

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

CVE-2026-48154

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...

CVE-2026-47682

CVAT contains a path-containment validation flaw in versions 1.6.0–2.64.0. An attacker with write access to a cloud storage added to a CVAT instance, or the ability to add new cloud storages, can overwrite arbitrary files on the server filesystem. The issue enables arbitrary path writes at multip...

CVE-2026-48154 GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...

CVE-2026-66300

SNOMED International Snowstorm has a reflected XSS vulnerability in the Web Route redirection feature. An attacker can inject arbitrary JavaScript that executes when a user visits a crafted link. Affected software/version details are not enumerated in this summary beyond Snowstorm; the vulnerabil...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...