Linux Distros Unpatched Vulnerability : CVE-2026-109379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timi...

EUVD-2026-102496

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352 ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352 ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352 ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

CVE-2026-111352: Incorrect Authorization

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no adminapi rule exists. Attackers with a valid admin-type API token can list...

PT-2026-115296

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check fails open when no admin api rule exists. Attackers with a valid admin-type API token can lis...

CVE-2026-109379

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379 Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379 Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

EUVD-2026-97877

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379 Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379

Cockpit CMS 2.14.1 is affected by an observable timing discrepancy vulnerability within the /auth/check endpoint. Due to an incomplete timing fix, an unauthenticated remote attacker can enumerate valid user accounts by submitting login requests and measuring the processing duration. The vulnerabi...

CVE-2026-109379

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-109379: Observable Timing Discrepancy

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

PT-2026-110928

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783: Origin Validation Error

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...