EUVD-2026-67261

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

CVE-2026-37069

The Veno File Manager Project version 4.4.9 is susceptible to an Absolute Path Disclosure vulnerability. An unauthenticated attacker can identify the system directory where the application code is running by sending a GET request to the /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath...

CVE-2026-45694

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The paramete...

EUVD-2026-66772

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The paramete...

CVE-2026-45694 LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The paramete...

CVE-2026-45694

LibreNMS (network monitoring system) is affected by a reflected XSS in the Proxmox application view (versions up to 26.4.0 ). The root cause is in LegacyController.php:75, where the page title is injected into a document.title JavaScript assignment via string interpolation. The instance and vmid ...

EUVD-2026-66132

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

GHSA-H3X4-894J-XPX5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

CVE-2026-41262: Incorrect Authorization

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

Whistle vulnerable to path traversal

This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University. Vulnerability detail: In service.js, inside app.get'/cgi-bin/temp/get', ...: var filename = req.query.filename; if...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab Inc. has identified vulnerabilities in the GitLab Community Edition CE and Enterprise Edition EE. These vulnerabilities reside in the GraphQL implementation of GitLab. The first vulnerability allowed unauthorized users to perform unauthorized modifications or deletions on public projects a...

CVE-2026-77357: Uncontrolled Resource Consumption

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

CVE-2026-79666: Missing Authorization

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: A possible memory leak has been fixed in btrfsgetdevargsfrompath. In btrfsgetdevargsfrompath, btrfsgetbdevandsb may fail if the path is invalid. In such cases, btrfsgetdevargsfrompath returns directly without freeing the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: hi846: The usage of pmruntimegetifinuse has been corrected. pmruntimegetifinuse not only returns non-zero values when the device is in use, but it can also return a negative errno. Especially during resume from system...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: powerpc/pci: Fixed the locking behavior of getphbnumber. The recent change to getphbnumber causes a DEBUGATOMICSLEEP warning on some systems: - Bug: A sleeping function is called from an invalid context at...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext2/dax: Fixed ext2setsize when len is page-aligned. The PAGEALIGNx macro returns the next highest value that is a multiple of the page size. However, if x is already page-aligned, it simply returns x. Therefore, if x is passed ...

CVE-2026-76842: Improper Limitation of a Pathname to a Restricted Directory

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

Exploit for CVE-2026-78122

CVE-2026-78122 — Proof of Concept Tecnativa docker-socket-...

CVE-2026-78122 docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...