CVE Vulnerabilities - 26 June 2026

Prior to Kestra version 1.0.45 and 1.3.21, an attacker could bypass authentication and create a flow that runs as the root user. This could allow the attacker to access sensitive data on the host syst...

An open-source platform used for workflow orchestration has a security flaw that allows unauthorized access to its configuration settings. This can lead to unauthenticated users executing arbitrary co...

A security issue in mcp-pinot versions 3.0.1 and below allows unauthorized access to Apache Pinot data. This is because the MCP server does not require a password to connect, making it vulnerable to a...

The WSO2 API Manager's message flow component does not properly check user input in certain headers. This allows an attacker to control where internal server requests go, potentially giving them acces...

Nezha's terminal and file manager features have a security flaw that allows an attacker to take control of a session on a remote server. This can happen if an attacker learns the ID of a live session ...

In Nezha versions v1.14.13 to v1.14.14 and v2.0.0 to v2.0.9, a user can access another user's live terminal sessions without permission. This allows an attacker to gain interactive shell access to the...

Versions of the Deepstream server prior to 10.0.5 contain a security flaw that allows an authenticated user with write permission to access and modify sensitive data. This could potentially give the u...

OpenProject's project management software had a security weakness that could have allowed hackers to access sensitive information. This weakness has been fixed in versions 17.3.3 and 17.4.1, so users ...

A project administrator in one project can access and manage the files of another project on the same storage. This is a security risk because it allows unauthorized access to sensitive project inform...

OpenProject's Docker image exposes a sensitive key, which can be used by attackers to access user sessions. This is a security concern because it could allow unauthorized access to project management ...

A malicious image server can write files to any location on the Incus server, potentially allowing an attacker to execute commands as root. This is due to a weakness in how Incus handles image downloa...

A vulnerability in Incus's backup compression feature allows attackers to write arbitrary files on the host, potentially leading to unauthorized access. This issue affects Incus's backup compression f...

A vulnerability in Incus's S3 protocol upload endpoint allows attackers to create arbitrary files on the host, potentially leading to unauthorized command execution. This affects Incus users who rely ...

Incus, a container management software, can be tricked into allowing malicious images to read and write files on the host system. This could potentially allow an attacker to execute malicious code on ...

Incus has a security issue that allows a malicious user to bypass project restrictions and execute arbitrary commands on the server with root privileges. This is a serious problem because it could all...

A vulnerability in Incus allows attackers to write files to arbitrary locations on the host system by creating a specially crafted image. This can potentially lead to unauthorized command execution. T...

A malicious image can read and write any file on the host, potentially allowing an attacker to execute any command. This is a serious security risk, and users should be cautious when importing images ...

A configuration mistake in Dokku's app settings can allow an attacker to run commands on the server as the Dokku user. This could lead to unauthorized access and potentially allow the attacker to take...

Travel Booking software versions 2.2.5 and earlier allow attackers to upload unauthorized files. This could lead to malicious code being executed on the server, potentially compromising the entire sys...

Quform, a WordPress plugin, allows attackers to upload any file on the server. This can lead to unauthorized data access or server compromise. Update Quform to version 2.24.0 or later to fix this issu...

The Booster for WooCommerce plugin allows customers to upload files without proper validation, which means they can potentially upload malicious files. This could lead to security risks and compromise...

DMP-5000 security devices come with a default admin account that isn't changed during setup. This allows unauthorized access to the device's system. To fix this, change the admin account password imme...

A security issue in FFmpeg's media handling could allow attackers to create malicious media files that can cause FFmpeg to crash or potentially execute unauthorized code. This affects users who proces...

A bug in the Linux kernel's ocfs2/dlm module could cause it to access memory outside its intended range, potentially leading to crashes or other issues. This issue has been fixed in the latest kernel ...

A bug in the Linux kernel's region comparison loop has been fixed. This bug could have allowed an attacker to read or write data outside of allowed areas, potentially leading to data corruption or sec...