Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: resource-agents (UTSA-2026-103696)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103696 advisory. pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact...

PT-2026-80650

Summary Repo under test: https://github.com/Netflix/lemur When ADMIN ONLY AUTHORITY CREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent...

SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...

DoS (Denial of Service) Apache Tomcat Dependency in Crowd Data Center and Server

This High severity DoS Denial of Service vulnerability known as CVE-2026-13506 was introduced in 6.1.0 and later of Crowd Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

CVE-2026-61008

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61817

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Application Testing Suite executes to...

CVE-2026-55164

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...

CVE-2026-55164 Lemur: Plaintext password storage in Lemur user-update path

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...

CVE-2026-55164 Lemur: Plaintext password storage in Lemur user-update path

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...

CVE-2026-55164 Lemur: Plaintext password storage in Lemur user-update path

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...

CVE-2026-55163

Lemur (Netflix TLS certificate management tool) has an authorization bypass in PUT /api/1/roles/ (lemur/roles/views.py:298): RoleMemberPermission uses OR-semantics, so any existing role member can add/remove other users and rename the role. The companion DELETE handler already required admin perm...

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively...

tenzir v6.12.0-rc.1

Data Pipelines for Security Teams Collect, transform, enrich, and route your telemetry—all in one place. What is Tenzir? Tenzir is the data pipeline engine for security teams. If you need to collect, parse, shape, normalize, aggregate, store, query, and route security telemetry data at scale,...

PT-2026-77579

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description A flaw in the Installation and Configuration component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the...

Ubuntu Security Notice USN-8640-1

Ubuntu Security Notice 8640-1 - It was discovered that Engrampa incorrectly handled symbolic links when extracting certain archives. An attacker could possibly use this issue to write arbitrary files and execute arbitrary code...

PT-2026-80275

Summary Repo under test: https://github.com/Netflix/lemur When ADMIN ONLY AUTHORITY CREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent...

PT-2026-80301

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

PT-2026-80234

Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/ -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints POST/PUT/DELETE a...

CVE-2026-71417: Authorization Bypass Through User-Controlled Key

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-71307: Missing Authorization

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...