ALSA-2026:6383 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...

Oracle Linux 9 : python3.11 (ELSA-2026-6286)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-6286 advisory. 3.11.13-5.2.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-5.2 - Security fix for CVE-2026-4519 Resolves: RHEL-158050 Tenable has extracted the...

RHEL 10 : grafana (RHSA-2026:6344)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:6344 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/url: Incorrect...

ALSA-2026:6382 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

ALSA-2026:6388 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper handling of IPv6 special-use address ranges in the src/shared/net/ip.ts and src/infra/net/ssrf. components. An attacker can access internal o...

CVE-2026-34222

creationtimestamp| type| source ---|---|--- 2026-03-31 23:58:42+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m 2026-04-02 06:21:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miikujwojm2c 2026-04-03...

CLSA-2026-1774996482 golang: Fix of CVE-2026-25679

CVE-2026-25679: fix insufficient validation of host/authority in url.Parse that allowed invalid URLs; strengthen parsing and reject malformed host and authority components - fix-smtp-test-expired-cert: fix expired TLS test certificate in net/smtp tests; replace with upstream long-lived cert...

CVE-2026-34366

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifvvsbkbx2x 2026-04-08 02:20:09+00:00| seen|...

CVE-2026-34367

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01 05:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifvvyxjwx2x...

Cross-site Request Forgery (CSRF)

Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the approval process for pending user registrations in modules/registration.php when handling the...

CVE-2026-33027

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operati...

GHSA-3X2W-63FP-3QVW SciTokens has an Authorization Bypass via Path Traversal in Scope Validation

Summary The Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot .. in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path from the token and the requested path from the...

SciTokens has an Authorization Bypass via Path Traversal in Scope Validation

Summary The Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot .. in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path from the token and the requested path from the...

CVE-2026-21712

A flaw was found in Node.js. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a malformed Internationalized Domain Name IDN to the url.format function. When processed, this malformed input triggers an internal error, causing the Node.js application to crash. Thi...

CVE-2026-34448

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From - Asset Field” enabled. The vulnerable code accepts arbitrary...

EUVD-2026-17675

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From - Asset Field” enabled. The vulnerable code accepts arbitrary...

CVE-2026-34442

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version http://localhost:8080/system/status allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External...

CVE-2026-34740 AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG Electronic Program Guide link feature in AVideo allows authenticated users with upload permissions to store arbitrary URLs that the server fetches on every EPG page visit. The URL is validated only with PHP's...

CVE-2026-34740

WWBN AVideo (versions 26.0 and prior) contains a stored SSRF in the EPG link feature. Authenticated users with upload permissions can store arbitrary URLs that the server fetches on each EPG page visit. The URL validation relies only on PHP FILTER_VALIDATE_URL, which accepts internal network addr...