CVE-2026-95835 Missing ownership check on the shared memory object named by the kitty askpass escape code

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

CVE-2026-61837 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...

CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-67241

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

EUVD-2026-87153

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-67241 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-67241

A flaw in rabbitmq-server allows an authenticated user to bypass access controls and perform unauthorized message routing . Specifically, the AMQP 1.0 management exchange.declare operation fails to verify write permissions for the specified alternate-exchange . This allows an attacker with config...

CVE-2026-100177

The AIL Framework crawler contains an authorization flaw in the api_add_crawler_task API. The application fails to validate organizational boundaries or user roles when a user provides a cookiejar UUID for one-shot or scheduled crawler tasks. Specifically, if a cookiejar's access level is not 0, ...

BIT-GITLAB-2026-86341 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

DEBIAN-CVE-2026-98057

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

CVE-2026-98057

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

DEBIAN-CVE-2026-98040

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTRMAYBENULL from rA in the corresponding...

CVE-2026-98040

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTRMAYBENULL from rA in the corresponding...

DEBIAN-CVE-2026-98002

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...

UBUNTU-CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

UBUNTU-CVE-2026-97917

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

UBUNTU-CVE-2026-98057

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

UBUNTU-CVE-2026-98002

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...