| RHSA-2026:60856 |
Red Hat Hardened Images RPMs Security Update
|
Red Hat |
2026‑08‑29 |
Low |
| RHSA-2026:60855 |
Red Hat Hardened Images RPMs Security Update
|
Red Hat |
2026‑08‑29 |
Low |
| GHSA-8FRH-VHGH-64CF |
Snipe-IT has incorrect permission for legacy license checkin API
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-86M2-FCXQ-5Q7C |
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
|
GitHub |
2026‑08‑28 |
High |
| GHSA-79CW-HFCC-7MW9 |
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password…
|
GitHub |
2026‑08‑28 |
High |
| GHSA-786W-P5PM-CVGH |
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
|
GitHub |
2026‑08‑28 |
High |
| GHSA-73P9-6HRP-8QHR |
AIIR verification and policy gates could report success without enforcing the control (fail-open)
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-64F3-V33M-W89F |
Incus has a project restriction bypass for custom volume copy across projects
|
GitHub |
2026‑08‑28 |
High |
| GHSA-5WX7-XQ8J-V4QM |
Snipe-IT's import created_by can be overwritten
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-5V29-34H8-V68R |
MapFish Print has XXE that allows reading arbitrary files of certain types
|
GitHub |
2026‑08‑28 |
High |
| GHSA-5RQC-86VF-G8R2 |
org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-575R-357H-FHCH |
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
|
GitHub |
2026‑08‑28 |
High |
| GHSA-56WQ-X3WV-3FF4 |
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
|
GitHub |
2026‑08‑28 |
High |
| GHSA-53JC-27PC-X8R8 |
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-42R5-VHPQ-M858 |
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-35CR-9HQQ-P2MG |
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-334Q-H5G3-FPXV |
free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
|
GitHub |
2026‑08‑28 |
High |
| GHSA-2Q2Q-JR9G-V9RF |
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
|
GitHub |
2026‑08‑28 |
High |
| GHSA-2P9G-X3CV-5HH4 |
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
|
GitHub |
2026‑08‑28 |
Medium |
| GHSA-2GH4-JMWQ-RR8W |
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
|
GitHub |
2026‑08‑28 |
High |