io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5), io.camunda:tasklist-webapp (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5) +11 more potentially affected by CVE-2026-103007 via org.elasticsearch:elasticsearch (>=8.16.0, <=8.19.21)

org.elasticsearch:elasticsearch MAVEN version =8.16.0, =8.9.0-alpha5-rc1, =8.9.0-alpha5-rc1, =main-272, =main-272, =main-272, =0.96.0, =7.29.0, =8.16.0, =8.16.0, =3.0.0-rc1, =1.7.es8171.0, =8.16.0, =8.19.21 Source cves: CVE-2026-103007 Source advisory: SNYK:JAVA-ORGELASTICSEARCH-20937074...

GHSA-4672-HWV6-GQ62 Trigger.dev: Cross-environment deployment cancel

Summary Trigger.dev isolates each project into multiple environments dev, staging, prod, and per-PR preview branches, each with its own secret API key — the environment is a trust boundary a dev/preview/CI key is lower-trust than a prod key. Most API routes enforce this by scoping resource lookup...

Trigger.dev: Blind SSRF via alert-channel webhook

Summary A WEBHOOK alert channel stores a user-supplied url. When an alert fires deployment/run failure, error groups, the webapp server alertsWorker - DeliverAlertService POSTs the HMAC-signed alert payload to that URL via fetchwebhook.url, .... The URL is never validated against a host allowlist...

GHSA-Q567-CR4X-96W4 Trigger.dev: Blind SSRF via alert-channel webhook

Summary A WEBHOOK alert channel stores a user-supplied url. When an alert fires deployment/run failure, error groups, the webapp server alertsWorker - DeliverAlertService POSTs the HMAC-signed alert payload to that URL via fetchwebhook.url, .... The URL is never validated against a host allowlist...

autoreduce-db (>=0.1.0, <=22.0.0.dev1), autoreduce-frontend (>=21.1.1, <=21.1.3) +4 more potentially affected by CVE-2026-15307 via django (3.2.2)

django PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =21.1.2, =21.1.4 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

CLEANSTART-2024-OU15582 Chromium: CVE-2021-30622 Use after free in WebApp Installs

Security vulnerability affects the chromium package. Chromium: CVE-2021-30622 Use after free in WebApp Installs...

CLEANSTART-2024-VI83166 Use after free in WebApp Installs in Google Chrome prior to 102

Security vulnerability affects the chromium package. Use after free in WebApp Installs in Google Chrome prior to 102...

CLEANSTART-2024-TO71899 Use after free in WebApp Provider in Google Chrome prior to 103

Security vulnerability affects the chromium package. Use after free in WebApp Provider in Google Chrome prior to 103...

Rocky Linux 8.8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_0333)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260333 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 8.8. It addresses 3 CVEs: CVE-2024-23672, CVE-2025-24813, CVE-2024-24549. Tenable...

Rocky Linux 9.4 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_0583)

The Rocky Linux 9.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260583 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 9.4. It addresses 2 CVEs: CVE-2025-24813, CVE-2024-50379. Tenable has extracted th...

Rocky Linux 9.6 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_1496)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261496 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 9.6. It addresses 37 CVEs: CVE-2016-5425, CVE-2024-23672, CVE-2018-1304,...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2026:1779805268)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779805268 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 8.8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ciqsa-2026_1110)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261110 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-34750. Tenable has extracted the preceding description...

Rocky Linux 8.8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ciqsa-2026_1019)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261019 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2023-46589. Tenable has extracted the preceding description...

org.jasig.portal.fbms:fbms-webapp (>=0.9.0, <=0.9.2), org.webjars.npm:adal-node (0.1.28) +88 more potentially affected by CVE-2026-103387 via org.webjars.npm:uri-js (>=3.0.2, <=4.4.1)

org.webjars.npm:uri-js MAVEN version =3.0.2, =0.9.0, =6.4.0, =1.5.2, =2.1.0, =0.1.3, =1.4.1 - org.webjars.npm:eureka-js-client 4.3.0 and more Source cves: CVE-2026-103387 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-20341610...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778130778)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778130778 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778130778)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778130778 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1757011448)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1757011448 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

CVE-2026-58504

CVE-2026-58504 is a Stored XSS in draw.io prior to version 30.2.5 , constituting a patch bypass of CVE-2026-46642 . When a victim opens or imports a crafted .drawio file, a pair of sibling cells triggers the vulnerability: an HTML cell keeps the formatted-label path active while an editable=0 pla...

PT-2026-96147

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.5 Description Opening or importing a specially crafted .drawio file can lead to the execution of attacker-controlled JavaScript within the draw.io origin. This occurs when selected cells are processed by the...