EUVD-2026-89632

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

MiracleLinux 8 : perl-DBI-1.641-3.el8_10 (AXSA:2026-1942:06)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1942:06 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block...

AZL-105462 CVE-2026-35191 affecting package cloud-hypervisor 52.0.152-1

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

CVE-2026-35191

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...

CVE-2026-81930

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

CVE-2026-86843 Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize

NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.6...

CVE-2026-102267

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result,...

GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses

Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...

CVE-2026-101057 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

RLSA-2026:71608 Important: perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: DBI for Perl: Heap...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interface module for the...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interface module for the...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

SUSE-SU-2026:23919-1 Security update for perl-DBI

This update for perl-DBI fixes the following issue: - CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm attributes in DBD::DBM bsc1281704...

SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2026:4346-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4346-1 advisory. This update for perl-DBI fixes the following issue: - CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm...

ROS-20260925-73-0011

The vulnerability of the tuningctlset function in the sound subsystem of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...