AlmaLinux 9.6 [TuxCare] Security Update: openjpeg2 / openjpeg2-devel / openjpeg2-devel-docs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787149537)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787149537 advisory. - A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print...

AlmaLinux 9.2 [TuxCare] Security Update: golang / golang-bin / golang-docs / golang-misc / golang-race / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1748002217)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748002217 advisory. - Using go get to fetch a module with the .git suffix may unexpectedly fallback to the insecure git:// protocol if the module is...

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Overview Verified. Multiple Unrestricted Path Traversal vulnerabilities exist in the Knowns MCP docs and memory tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions Get, Create, Update, Rename, Delete in both docstore.go and...

CVE-2026-97879

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely...

CVE-2026-97879 zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely...

EUVD-2026-87202

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely...

CVE-2026-97879

A security flaw exists in zhistaredu StarTraining up to version 3.8.1 within the api-docs Endpoint . The vulnerability stems from an unknown function in the SecurityConfig.java file, which allows for missing authentication via remote manipulation. An exploit has been released to the public and ma...

CVE-2026-97879: Missing Authentication for Critical Function

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely...

CVE-2026-92800

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-92800

Docs (by suitenumerique) versions before 5.4.1 fail to properly revoke websocket collaboration connections when access is revoked at parent documents. This allows an attacker whose access has been revoked to retain real-time read and write access to sub-documents through stale websocket sessions ...

CVE-2026-92800 Docs before 5.4.1 Stale Collaboration Session After Access Revocation

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-92800 Docs before 5.4.1 Stale Collaboration Session After Access Revocation

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

EUVD-2026-81060

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-92800 Docs before 5.4.1 Stale Collaboration Session After Access Revocation

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-91081

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91081

Docs by Suitenumerique (versions through 5.6.1 ) contains a server-side request forgery (SSRF) vulnerability in the cors-proxy endpoint. The root cause involves DNS time-of-check-time-of-use (TOCTOU) race conditions and shared address space bypasses , allowing anonymous attackers to forge outboun...

CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

EUVD-2026-77716

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...