Rustls versions 0.23.13 through 0.23.44 incorrectly accept TLS 1.3 handshake messages sent at the wrong encryption level when they follow a key-changing message in the same record. This violates RFC 8446 section 5.1, which requires handshake messages to align with record boundaries around key changes. While the handshake transcript remains authenticated, this flaw allows a peer to send handshake messages that should be encrypted in plaintext without rustls rejecting the connection.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent API token. The token provides ongoing read and write access to notes, folders, tags, resources, and master keys. This issue is fixed in version 3.7.13.
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data and using the server as a network pivot. This issue is fixed in version 1.13.0.
Red Hat Single Sign-On is an integrated sign-on solution, available as a
Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat
Single Sign-On for OpenShift image provides an authentication server that
you can use to log in centrally, log out, and register. You can also manage
user accounts for web applications, mobile applications, and RESTful web
services.
This erratum releases a new image for Red Hat Single Sign-On 7.6.13 for
use within the OpenShift Container Platform 3.10, OpenShift Container Platform
3.11, and within the OpenShift Container Platform 4.3 cloud computing
Platform-as-a-Service (PaaS) for on-premise or private cloud deployments,
aligning with the standalone product release. This security update has moderate
impact.
Security fixes:
* undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)
* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)
* Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543)
* Information disclosure and data deletion via second-order SQL injection (CVE-2026-0603)
* GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)
* PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588)
* unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505)
* High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
* HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
* HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
* Denial of Service via malformed HAProxy message (CVE-2026-44893)
* Denial of Service due to resource leak (CVE-2026-48043)
* Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
* Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
* Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010)
* Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
* Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
* Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
* Denial of Service via deeply nested JSON processing (CVE-2026-50193)
* Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
* Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563)
* Session fixation in OIDC login flow that can lead to account takeover (CVE-2026-7507)
* Denial of Service via specially crafted SAML input (CVE-2026-7307)
* Denial of Service due to excessive SAMLRequest decompression (CVE-2026-2575)
* Denial of Service via excessive processing of OpenID Connect scope parameters (CVE-2026-4634)
* Unauthorized access via improper validation of encrypted SAML assertions (CVE-2026-2092)
CVE-2026-103349 is a high-severity vulnerability in Rymera Web Co's Product Feed PRO for WooCommerce plugin. It involves deserialization of untrusted data leading to object injection. This affects all versions from initial releases up to 13.5.7. The vulnerability allows an attacker with high privileges to potentially execute arbitrary code or cause denial of service. No patch or vendor advisory is provided in the input data.
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
CVE-2026-104409 is a stored cross-site scripting (XSS) vulnerability in the WP Chill Image Photo Gallery Final Tiles Grid plugin. It affects versions from initial release up to 3.6.13. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and requiring user interaction to execute malicious scripts. The CVSS score is 6.5, indicating a medium severity level.
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
CVE-2026-105174 is a path traversal vulnerability in Gerapy versions 0.9.0 through 0.9.13 affecting the project_create function in the Project Management component. This vulnerability allows remote attackers with limited privileges to manipulate the project_name argument to perform path traversal. The vulnerability has a medium severity with a CVSS score of 5.3. A patch identified by commit 6e481078cfba6388a67ca2d9792288405019ba3e is available and recommended to fix the issue.
CVE-2026-105144 is a path traversal vulnerability in the Drogon web framework affecting versions 1.9.13-1 and 10.0-beta.0 through 10.0-beta.3 on Windows. The flaw exists in the StaticFileRouter::route function, allowing remote attackers to manipulate file paths. Exploit code has been published, but there is no vendor response or patch available as of the disclosure date. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9.
A high-severity vulnerability (CVE-2026-88779) affects Citrix NetScaler ADC and NetScaler Gateway products, including their FIPS variants. Multiple versions prior to 14.1-73.41, 13.1-64.28, and 13.1-37.282 are impacted. The vulnerability is publicly known but no confirmed exploits have been observed in the wild. No patch or remediation information is currently available.