MINI-9XJ4-V79M-7JR7

Bulletin has no description...

MINI-MCR2-PHGP-JGFC

Bulletin has no description...

MINI-JQ78-M7V9-8J5V

Bulletin has no description...

MINI-Q6MW-84XM-X2QG

Bulletin has no description...

MINI-XVFH-RWGH-W8WV

Bulletin has no description...

MINI-RF4J-XM42-RCHV

Bulletin has no description...

MINI-CJWX-5FCR-FRCV

Bulletin has no description...

MINI-XR4J-F7CQ-4XF3

Bulletin has no description...

MINI-W7WF-H785-4GJF

Bulletin has no description...

MINI-JHX8-52VV-MFGM

Bulletin has no description...

MINI-VR58-5RH8-XX83

Bulletin has no description...

MINI-QCHJ-HJ87-8R6Q

Bulletin has no description...

MINI-V5QV-PX92-QHCV

Bulletin has no description...

MINI-VQH4-54VM-845M

Bulletin has no description...

MINI-426H-G9PR-CM4P

Bulletin has no description...

MINI-XMP5-QV8M-C39V

Bulletin has no description...

MINI-49MG-MM9W-VJ46

Bulletin has no description...

MINI-CJ7F-7FFM-H4MQ

Bulletin has no description...

MINI-83Q6-4JP4-4P89

Bulletin has no description...

MINI-XV66-WCVG-WP72

Bulletin has no description...

MINI-8W5R-74PP-V5FH

Bulletin has no description...

GHSA-JR34-H97M-9HPX nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

Summary The gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists...

GHSA-HF33-Q6CF-C66F nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

GHSA-JHJP-4C2Q-XMX4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-61851 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CGA-HV9Q-8XW3-6PJJ

Bulletin has no description...

CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-61743 Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

ROOT-OS-DEBIAN-12-CVE-2026-28902 CVE-2026-28902 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28902 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43725 CVE-2026-43725 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43725 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28904 CVE-2026-28904 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28904 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-20664 CVE-2026-20664 in webkit2gtk - Patched by Root

Root has patched CVE-2026-20664 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43660 CVE-2026-43660 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43660 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43715 CVE-2026-43715 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43715 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28953 CVE-2026-28953 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28953 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28847 CVE-2026-28847 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28847 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28905 CVE-2026-28905 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28905 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-4367 CVE-2024-4367 in webkit2gtk - Patched by Root

Root has patched CVE-2024-4367 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28859 CVE-2026-28859 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28859 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28907 CVE-2026-28907 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28907 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43705 CVE-2026-43705 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43705 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28946 CVE-2026-28946 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28946 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28942 CVE-2026-28942 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28942 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43731 CVE-2026-43731 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43731 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28947 CVE-2026-28947 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28947 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

CGA-5H23-35W2-4J84

Bulletin has no description...

MAL-2026-16370 Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...