PYSEC-2026-2068 Improper line feed handling in zenml

A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...

CVE-2026-12948 Stored Cross-Site Scripting (XSS)

A stored cross-site scripting XSS vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the...

EUVD-2026-42048

A stored cross-site scripting XSS vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the...

CVE-2026-12948

The CVE-2026-12948 vulnerability affects the web management interfaces of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA. It is a stored XSS (CWE-79) that permits a remote, authenticated administrator to inject script into certain system configuration fields; the script can exec...

CVE-2026-53878 Header injection possibility since DomainNameValidator accepted newlines in input

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names unless used via a form field, since CharField strips newlines. If an application uses values with newlines in an HTTP response, header injection can occur. Djan...

EUVD-2026-42045

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names unless used via a form field, since CharField strips newlines. If an application uses values with newlines in an HTTP response, header injection can occur. Djan...

CVE-2026-53878 Header injection possibility since DomainNameValidator accepted newlines in input

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names unless used via a form field, since CharField strips newlines. If an application uses values with newlines in an HTTP response, header injection can occur. Djan...

CVE-2019-16728

creationtimestamp| type| source ---|---|--- 2026-07-07 14:02:53+00:00| seen| https://gist.github.com/UltraRamy/b344c7471b63468d9b5bc7bd3f33c59c...

MAL-2026-7421 Malicious code in sitefinitywebapp (npm)

--- -= Per source details. Do not edit below this line.=-...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the /skin/ action endpoint when running on Jetty 12 or later. An attacker can access arbitrary files on the server by crafting a URL containing encoded directory traversal sequences. This is only exploitable if th...

MAL-2026-7313 Malicious code in liportal-web-app (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7250 Malicious code in divvy-web (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7104 Malicious code in @xp-utilities/web (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7086 Malicious code in @mts-pay/web-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7079 Malicious code in @karakuri-web-fgsfgehfg/common (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7056 Malicious code in @bmg-web/bmg-styles (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7050 Malicious code in @bmg-web/bmg-core (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2021-20173

creationtimestamp| type| source ---|---|--- 2026-07-07 12:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq2kxfyzo62o...

mod_http2 security, bug fix, and enhancement update

An update is available for modhttp2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top o...

PYSEC-2026-1516 Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever

A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet...