CVE-2026-24855

ChurchCRM has a Stored Cross-Site Scripting (XSS) vulnerability in the Church Calendar Create Events feature, affecting versions prior to 6.7.2. Low-privilege users can insert XSS payloads into the Description field, which is stored in the database; when other users, including admins, view the ev...

EUVD-2026-4753

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects...

SUSE CVE-2026-22862

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8...

Advisory ROSA-SA-2026-3126

software: suricata 7.0.12 AXIS: ROSA-CHROME unaffected versions = suricata-7.0.12-1 affected versions suricata-7.0.12-1 CVE-ID: CVE-2025-59147 BDU-ID: 2025-12460 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Suricata Intrusion Detection and Prevention System is related to incorrect security...

Advisory ROSA-SA-2026-3121

software: binutils 2.38 WASP: ROSA-CHROME unaffected versions = binutils-2.38-7 affected versions binutils-2.38-7 CVE-ID: CVE-2025-5244 BDU-ID: 2025-10924 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the elfgcsweep function of the ld component of the GNU Binutils software development tool is...

CVE-2026-24405

The CVE-2026-24405 entry concerns iccDEV libraries. Affected software: iccDEV versions 2.3.1.1 and earlier. Vulnerability: Heap Buffer Overflow in CIccMpeCalculator::Read(), triggered when user-controlled input is unsafely incorporated into ICC profile data or other structured binary blobs. Poten...

CVE-2026-24399 ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution

ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below, the chatbot accepts and executes malicious HTML/JavaScript payloads when supplied as chat input. Specifically, an payload containing a javascript: URI can be processed and executed in the browser context. This allow...

EUVD-2026-4216

Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint initiates Slack OAuth using a projectId provided by the client without authentication or authorization. The projectId is preserved throughout the OAuth flow,...

Azure Linux 3.0 Security Update: kernel (CVE-2024-49912)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49912 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle null...

PT-2026-3873

Name of the Vulnerable Software and Affected Versions Flux Operator versions 0.36.0 through 0.39.9 Description The Flux Operator, a Kubernetes CRD controller, contains a flaw in its Web UI authentication code. This issue allows an attacker to bypass Kubernetes RBAC impersonation and execute API...

python-keystonemiddleware-doc-10.12.0-2.1 on GA media (moderate)

python-keystonemiddleware-doc-10.12.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:10070-1 Rating: moderate Cross-References: CVE-2026-22797 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed i...

CVE-2026-23844 Whisper Money has IDOR Vulnerability on sync/balances endpoint

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue...

CVE-2026-23721 OpenProject users with "View Members" permission in any project can view all Group memberships

OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, d...

MiracleLinux 4 : pango-1.28.1-3.AXS4.5 (AXSA:2011-72:02)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-72:02 advisory. Pango is a system for layout and rendering of internationalized text. Security issues fixed with this release: CVE-2011-0064 No information available at the ti...

MiracleLinux 4 : virt-v2v-0.8.3-5.0.1.AXS4 (AXSA:2012-50:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-50:01 advisory. virt-v2v is a tool for converting virtual machines to use the KVM hypervisor. It modifies both the virtual machine image and its associated libvirt metadata...

EUVD-2026-3136

A vulnerability was identified in Open5GS up to 2.7.5. This vulnerability affects the function sgwcbeareradd of the file src/sgwc/context.c. The manipulation leads to reachable assertion. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The...

CVE-2026-0616

TheLibrarians webfetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibrarian backend system. The vendor has fixed the vulnerability in all affected versions...

CVE-2026-23643

Removed by vendor...

CVE-2026-23523 Dive allows One-click Remote Code Execution through Deep Links for MCP Install

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation and can lead to arbitrary local command execution on the...

CVE-2026-0615

The Librarian supervisord status page can be retrieved by the webfetch tool, which can be used to retrieve running processes within TheLibrarian backend. The vendor has fixed the vulnerability in all affected versions...