MINI-4WWF-W24H-69QX

Bulletin has no description...

MINI-3QMG-W496-F322

Bulletin has no description...

MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

CGA-QP8P-JVPW-PGV5

Bulletin has no description...

CGA-7M59-5RJF-M974

Bulletin has no description...

CGA-8773-88J3-838W

Bulletin has no description...

CGA-838R-H9WJ-69G3

Bulletin has no description...

CGA-WP3C-7HQF-493P

Bulletin has no description...

CGA-MFMQ-X872-2HRC

Bulletin has no description...

CGA-8P2M-RR39-73WG

Bulletin has no description...

CGA-H3PM-88MP-9V48

Bulletin has no description...

AZL-103410 CVE-2026-96269 affecting package emacs 29.4-6

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...

DEBIAN-CVE-2026-96269

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...

DEBIAN-CVE-2026-91018

lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

DEBIAN-CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

UBUNTU-CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

UBUNTU-CVE-2026-91018

lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

UBUNTU-CVE-2026-96269

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...

CGA-27CF-66PP-JV6F

Bulletin has no description...

CGA-P448-7P2X-CGHQ

Bulletin has no description...

MAL-2026-16411 Malicious code in no-fun (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...

CLSA-2026-1790110789 TuxCare security update for fastify (3 CVEs)

TuxCare rebuilt fastify to address 3 CVEs. Fixed in 5.2.1-tuxcare.2...

MAL-2026-16410 Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...

GHSA-WX4M-69M9-GX3M Home Assistant: XSS in Statistics Graph Card

Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that entity, when they hover over any data point on the chart. Payload Payload triggering An alternative,...

GHSA-4GHV-53CQ-7WP3 Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

GHSA-8FCF-V89G-XPG6 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

GHSA-992G-9CR3-VM5X Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Cross-tenant disclosure risk on DurableTask bidi RPC This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via th...

GHSA-9Q4H-F4X5-FFQ8 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Summary The V1 DurableTask stream handler registers worker-supplied durable task external IDs in an in-memory callback routing map before verifying that the authenticated tenant owns the task. If the tenant-scoped ownership check fails, the handler logs the error and continues, but the map entry...

GHSA-JVH5-97XG-V99F Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Summary Cloudreve's server-side request forgery guard ValidateExternalURL pkg/request/ssrf.go resolves a user-supplied URL host and rejects it when any resolved IP is a loopback, private, link-local, multicast, unspecified, CGNAT, or the cloud-metadata address. The classification is performed by...

GHSA-GFJV-GQF2-C888 Gardener: Authorization Bypass via Group Subject Injection

Overview The manage-members custom verb authorization check in the Gardener API server's customverbauthorizer admission plugin can be bypassed by adding Group or ServiceAccount subjects to a Project's member list. The check is documented as controlling "human users or groups", but the...

GHSA-W89X-C962-C44G Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are missing the write-scope enforcement that their neighboring endpoints correctly apply. Specifically, the WOPI configuration fetch endpoint and the SMTP test/mail endpoint can both be...

GHSA-XJ3H-WWXQ-GFCJ Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Summary Cloudreve v4 splits the storage-quota check reading the user's used bytes and comparing them to MaxStorage and the charge incrementing users.storage into two non-atomic steps in the PrepareUpload code path. This creates a Time-of-Check to Time-of-Use TOCTOU race condition. Any authenticat...

GHSA-4825-P4XM-PCF2 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

GHSA-XPJQ-3W4W-W5WR lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

Summary The LightRAG WebUI renders assistant/answer chat content as raw HTML — react-markdown is configured with rehypePlugins=rehypeRaw and skipHtml=false and no HTML sanitizer rehype-sanitize, element allow-list, or custom urlTransform. Because answer content is derived from user-ingested...

GHSA-VV3M-F8X4-7377 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

GHSA-FRCH-4W6V-Q5XX lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightragserver.py:2161 @app.post"/login" async def loginformdata: OAuth2PasswordRequestForm =...

GHSA-C759-CX9P-MRWQ lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Summary When plaintext passwords are stored in AUTHACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character. Details python lightrag/api/passwords.py:13-26 def...

CLSA-2026-1790109523 TuxCare security update for 14 packages (2 CVEs)

TuxCare rebuilt 14 packages to address 2 CVEs. Fixed in 3.2.4-tuxcare.2...

GHSA-HRMJ-7RVJ-4HG8 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

GHSA-Q4C5-2J6F-R476 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

GHSA-56V6-2FHR-WXGQ Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

GHSA-HXP9-W8X3-P566 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...

GHSA-JPVM-9FRM-HJCQ Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

GHSA-QGW5-7J4F-FG97 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

GHSA-XHMX-W2J4-RW3Q Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

GHSA-JPF4-98QJ-QR67 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

A vulnerability in Nuclei's DAST template loading path allows unsigned code: protocol templates to execute, bypassing the cryptographic signature requirement that is meant to prevent arbitrary command execution from untrusted templates. Affected Component The issue is in the template loader's DAS...

GHSA-VXG7-F2JJ-JMQM Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

A vulnerability in the Goja JavaScript engine used by Nuclei's javascript: protocol allows arbitrary native code execution on the scanner host when running untrusted JavaScript templates. Affected Component The issue is in the Goja JavaScript runtime embedded in Nuclei's JavaScript protocol...

GHSA-9XHM-W3WJ-XHQH Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...

GHSA-328G-JX67-V94G Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

tinyauth: forward-auth per-app ACL is matched case-sensitively against the case-insensitive hostname, letting an authenticated user reach apps they are not on the allowlist for GitHub Advisory Details form fields — paste-ready Affected products | Field | Value | |-------|-------| | Ecosystem |...

GHSA-456H-WW26-F758 Tinyauth: User enumeration attack by timing oracle

Summary It's possible to enumerate users through a timing oracle. In other words: I can easily check if a username exists or not by observing the timing differences between logins. PoC Setup a tinyauth server with a local user. It can be over the network. Try to log in with the local user, using ...