net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-78377 Open Redirect in Yordam Informatics's Library Automation System

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...

CVE-2026-78377

CVE-2026-78377 is an Open Redirect vulnerability in the Library Information and Document Automation Program by Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. The flaw allows URL redirection to an untrusted site, enabling phishing attacks. The af...

EUVD-2026-74783

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...

CVE-2026-78377 Open Redirect in Yordam Informatics's Library Automation System

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2021-23369 DESCRIPTION: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming...

CVE-2026-87567

A flaw was found in Google Chrome. This user interface UI misrepresentation in URL formatting allows a remote attacker to leverage social engineering techniques. By using a specially crafted domain name, the attacker can spoof the address bar, potentially deceiving users about the authenticity of...

MAL-2026-16064 Malicious code in bx-ui-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...

Malicious code in bx-ui-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...

PT-2026-88925

Name of the Vulnerable Software and Affected Versions Apache Parquet versions 1.12 through 1.18 Description The org.apache.parquet.crypto.keytools package allows for the encryption of Parquet files using an envelope encryption mechanism that wraps data keys via a Key Management Service KMS. When...

PT-2026-89237

Name of the Vulnerable Software and Affected Versions Drupal Central Authentication System CAS Server versions 0.0.0 through 2.0.4 Drupal Central Authentication System CAS Server versions 2.1.0 through 2.1.3 Description An open redirect issue exists because the module does not sufficiently valida...

Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

This module enables you to turn a Drupal install into the Central Authentication System CAS Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during...

CVE-2026-87996: Time-of-check Time-of-use (TOCTOU) Race Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

PT-2026-88959

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

PT-2026-89206

Name of the Vulnerable Software and Affected Versions WeasyPrint versions prior to 70.0 Description Server-side applications using WeasyPrint to render untrusted input may experience a bypass of the url fetcher mechanism, which is designed to restrict resource loading such as blocking file:// or...

PT-2026-89252

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module does no...

CVE-2026-81741: URL Redirection to Untrusted Site

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafte...

Important: python3.12-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: python-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-88912

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...