📂 TinyWeb Path Traversal Exposes Sensitive Server Files
Operators running TinyWeb through 0.0.8 should treat internet-facing deployments as urgent. Until remediation is available, restrict access, run the service with minimal privileges, and block traversal attempts at a trusted reverse proxy.
CVE-2026-67185 is a path traversal vulnerability in TinyWeb through 0.0.8 with CVSS 7.5 HIGH severity. Unauthenticated attackers can submit ../ sequences that reach filesystem operations without normalization or boundary checks, allowing arbitrary file reads. Sensitive credentials and private keys may be exposed, particularly when the server runs as root.
🔗 Read more 🔗
Source: NVD
💥 Malformed Requests Can Crash TinyWeb Servers
Internet-facing TinyWeb deployments need immediate defensive attention. Isolate the service where possible, validate requests upstream, and use process supervision while awaiting remediation.
CVE-2026-67184 is a null pointer dereference in TinyWeb through 0.0.8 with CVSS 7.5 HIGH severity. An unauthenticated remote attacker can send a malformed HTTP request line with an invalid version string, triggering a SIGSEGV in a worker process. Repeated requests can terminate every worker and leave the server offline until it is manually restarted.
🔗 Read more 🔗
Source: NVD
🧠 Ordinary Requests Can Exhaust TinyWeb Memory
TinyWeb administrators should treat this as an urgent availability risk, especially on public or memory-constrained systems. Enforce request limits, monitor memory consumption, and configure automatic worker restarts while awaiting remediation.
CVE-2026-67183 is a memory leak vulnerability in TinyWeb through 0.0.8 with CVSS 7.5 HIGH severity. Unauthenticated attackers can exhaust server memory using ordinary, well-formed HTTP requests because several request objects are allocated but never freed. Worker memory grows by approximately 20 to 28 kB per request until the process is killed.
🔗 Read more 🔗
Source: NVD
🚚 Rouille Request Smuggling Can Bypass Access Controls
Teams using affected Rouille versions as a proxy or gateway should prioritize containment, particularly around sensitive backend routes. Reject control characters in headers and avoid relying solely on Rouille-side authorization until remediation is available.
CVE-2026-67182 is an HTTP request smuggling vulnerability affecting Rouille 0.3.3 through 3.6.2 with CVSS 7.5 HIGH severity. Remote attackers can inject bare line feed characters into header values that Rouille forwards upstream without validation. A backend may interpret the injected content as a separate attacker-controlled request, bypassing access controls enforced by the Rouille handler.
🔗 Read more 🔗
Source: NVD
📡 QTI Neon Relay Amplification Threatens Game Hosts
QTI Neon operators should act immediately because no patched release is available. Restrict relay access, rate-limit reconnect traffic, monitor host load, and consider disabling affected relay functionality.
CVE-2026-54609 is a denial-of-service vulnerability in QTI Neon 1.0.0 with CVSS 8.6 HIGH severity. An unauthenticated client can send unbounded RECONNECT_REQUEST packets that the relay forwards to the host, creating relay-to-host amplification. No fixed version is available as of this review.
🔗 Read more 🔗
Source: NVD
🔑 Ruby OAuth Redirects Can Leak Signed Request Metadata
Ruby applications using affected OAuth versions should upgrade to 1.1.6 promptly, especially when connecting to external or untrusted OAuth servers. Rotate potentially exposed credentials if suspicious cross-origin redirects have occurred.
CVE-2026-54605 affects the Ruby OAuth library from 0.5.5 to 1.1.5 and has CVSS 7.2 HIGH severity. OAuth::Consumer#token_request recursively follows redirect locations that can alter the consumer configuration and expose signed OAuth request metadata, including the Authorization header, to a cross-origin host. The issue is fixed in version 1.1.6.
🔗 Read more 🔗
Source: NVD
🎫 Ruby OAuth2 Redirect Flaw Leaks Bearer Tokens
Applications using affected OAuth2 versions should upgrade to 2.0.22 immediately because leaked bearer tokens can enable account or API compromise. Review redirect activity and revoke or rotate tokens that may have been exposed.
CVE-2026-54603 affects the Ruby OAuth2 library from 0.4.0 to 2.0.21 and has CVSS 8.6 HIGH severity. A protocol-relative redirect can replace the request authority and cause OAuth2::Client#request to send its bearer Authorization header to an attacker-controlled host. The vulnerability is fixed in version 2.0.22.
🔗 Read more 🔗
Source: NVD
🖥️ BlackBerry UEM Console Hit by High-Severity XSS
BlackBerry UEM administrators should prioritize affected management consoles, particularly those accessible from untrusted networks. Restrict console access, limit administrator exposure to untrusted content, and monitor BlackBerry guidance for remediation details.
CVE-2026-18084 is a cross-site scripting vulnerability in the BlackBerry UEM Management Console with CVSS 8.6 HIGH severity. The issue results from improper neutralization of input during web page generation. BlackBerry UEM 12.23.0 QF8 or earlier is affected.
🔗 Read more 🔗
Source: NVD
🔌 Crafted SCSI Devices Can Trigger Root Command Execution
Linux administrators should urgently protect systems that process removable, virtual, or externally supplied SCSI devices. Limit device attachment privileges and avoid unsafe use of sg_inq –export in udev workflows until remediation is available.
CVE-2026-16313 is an input-sanitization flaw in sg3_utils with CVSS 7.6 HIGH severity. The sg_inq command fails to sanitize control characters in device identification fields when used with –export, allowing a crafted SCSI name to inject properties into the udev database. An attacker able to present a malicious SCSI device could execute arbitrary commands as root when the device is disconnected.
🔗 Read more 🔗
Source: NVD
🧨 Camaleon CMS Permission Flaw Enables Ruby Code Execution
Camaleon CMS owners should respond urgently by removing unnecessary custom_fields manage permissions and auditing suspicious field definitions. Restrict administrative access and investigate affected servers for evidence of code execution while awaiting remediation.
CVE-2026-66748 is an authenticated remote code execution vulnerability in Camaleon CMS versions 2.1.1 through 2.9.1 with CVSS 8.8 HIGH severity. A user with custom_fields manage permission can place a malicious Ruby expression in a select_eval field, which is later evaluated through instance_eval when a post edit page is rendered. Successful exploitation executes code with the privileges of the web server process.
🔗 Read more 🔗
Source: NVD
🚪 Pterodactyl Rate Limiter Lets Attackers Lock Out Every User
Pterodactyl administrators should upgrade to 1.13.0 promptly, especially for internet-facing panels. Until upgraded, apply per-source rate limiting at a reverse proxy and tightly restrict access to authentication endpoints.
CVE-2026-61609 is an authentication denial-of-service vulnerability in Pterodactyl from 1.7.0 until 1.13.0 with CVSS 7.5 HIGH severity. Login and two-factor endpoints share one global rate-limit bucket, allowing an unauthenticated attacker sending roughly ten requests per minute to trigger HTTP 429 responses for all users. The attack can lock out ordinary users and administrators, and the issue is fixed in version 1.13.0.
🔗 Read more 🔗
Source: NVD
📤 Pterodactyl JWT Replay Allows Unauthorized File Uploads
Upgrade both Pterodactyl Panel to 1.12.3 or later and Wings to 1.12.2 or later urgently, since partially trusted subusers can turn low-privilege tokens into file-write access. Review subuser activity and server files for unauthorized uploads after upgrading.
CVE-2026-54593 is an authorization flaw affecting Pterodactyl Panel before 1.12.3 and Wings before 1.12.2, with CVSS 8.1 HIGH severity. An authenticated subuser can replay a valid panel-signed JWT issued for a lower-privilege operation against the Wings /upload/file endpoint. This allows arbitrary file writes to the same server without the required file.create permission, and the issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
🔗 Read more 🔗
Source: NVD