151262 matches found
Ubuntu 24.04 LTS / 25.10 / 26.04 LTS : libssh2 vulnerabilities (USN-8486-1)
The remote Ubuntu 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8486-1 advisory. It was discovered that libssh2 incorrectly handled the sftpsymlink function. A malicious SSH server or machine-in-the-middle attacker...
CVE-2026-58419: Exposure of Sensitive Information to an Unauthorized Actor
Notification API leaks private issue metadata after access revocation...
CVE-2026-27783: Missing Authorization
Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints...
Linux Distros Unpatched Vulnerability : CVE-2026-13117
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session...
PT-2026-55595
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to scope the lookup of tracked-time entries to the specific issue provided in the request URL when searching by time ID. This flaw allows an attacker to attempt the deletion of time...
Apache ActiveMQ authorization issue vulnerability (CNVD-2026-28240)
Apache ActiveMQ is a message queue middleware product developed by the Apache Foundation. There is an authorization issue in Apache ActiveMQ; this vulnerability stems from improper authorization practices. As a result, low-privilege Web Console users who are authenticated may have access to the...
ROS-20260703-73-0017
The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...
Fedora 44 : leptonica / openqa / os-autoinst (2026-a72f110dcd)
The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-a72f110dcd advisory. This update includes new upstream snapshots of openQA and os-autoinst, with the usual mix of fixes and improvements. See upstream changelogs for details. For...
SUSE SLED15 / SLES15 Security Update : editorconfig-core-c (SUSE-SU-2026:2731-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2731-1 advisory. This update for editorconfig-core-c fixes the following issue: - CVE-2026-40489: improper use of strcpy can lead to a...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : curl vulnerabilities (USN-8487-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8487-1 advisory. Andrew Nesbitt discovered that curl could reuse an existing live connecti...
UBUNTU-CVE-2026-12413
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...
MINI-RH94-7XGJ-63MM
Bulletin has no description...
CVE-2026-12413
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...
CVE-2026-38969
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)
Summary Logic bug in decodesimpletableslow may cause integer arithmetic overflow when decoding Modular image with certain kind of MA tree, which may panic with overflow-checks enabled. Impact Denial of service: any application passing untrusted JXL data to JxlImage::renderframe or equivalent can ...
EUVD-2026-37811
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords...
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission. Description Craft CMS’s craft\controllers\AssetsController::actionMoveFolder supports moving an asset folder into a destination...
EUVD-2026-41428
Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary...
CVE-2026-59097 Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets
Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary...