PT-2026-105865

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

CVE-2026-55393: Improper Limitation of a Pathname to a Restricted Directory

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal...

PT-2026-105180

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max frame size, so cowboy's default of infinity...

Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc (crlsa-2025_18070)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202518070 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-43343 Tenable has extracted the preceding description block...

PT-2026-105790

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

PT-2026-103740

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a site administrator...

Linux Distros Unpatched Vulnerability : CVE-2026-102579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other studen...

Linux Distros Unpatched Vulnerability : CVE-2026-102578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries,...

CVE-2026-96268: Improper Neutralization of Input During Web Page Generation

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

The Innocent Courier: Covert Exfiltration through Legitimate LLM Web Fetching

With the increasing capabilities of Large-Language-Models LLMs and LLM-based agents, users are increasingly using them to solve everyday problems, such as answering e-mails or providing programming support. Existing work has extensively investigated security and privacy risks, such as prompt...

PT-2026-105789

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

CVE-2026-102394: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...

PT-2026-103744

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-14983: Missing Authentication for Critical Function

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint...

PT-2026-105178

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max frame size nor login timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small...

PT-2026-103910

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-78249: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

PT-2026-105192

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmq web mqtt/src/rabbit web mqtt handler.erl:104 nor the Web-STOMP handler deps/rabbitmq web stomp/src/rabbit web stomp handler.erl:102 validates the...

Linux Distros Unpatched Vulnerability : CVE-2026-102320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin...

Linux Distros Unpatched Vulnerability : CVE-2026-102329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted...