Linux Distros Unpatched Vulnerability : CVE-2026-83621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in...

PT-2026-97680

This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields...

The vulnerability of the Check Point Security Management Server and Multi-Domain Security Management Server software lies in the improper limitation of the path name to the directory. This allows attackers to execute arbitrary code.

The vulnerability of the Check Point Security Management Server and Multi-Domain Security Management Server software lies in incorrect path name restrictions for accessing the directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields...

Oracle Linux 8 : freerdp (ELSA-2026-69387)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-69387 advisory. 2:2.11.7-13 - Fix RPC gateway fragment size and capacity checks CVE-2026-55193 Resolves: RHEL-247353 Tenable has extracted the preceding description block...

ROS-20260923-73-0014

The vulnerability of the decodechooseargs function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, stems from an improper check of the specified index, position, or offset in the input data. Exploiting this vulnerability could allow a remote attacker to...

EUVD-2026-84867

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77426

The Unleash feature management platform (versions prior to 8.0.3 ) contains five authorization vulnerabilities in its admin API. A critical flaw in src/lib/features/segment/segment-controller.ts fails to await the hasPermission() call, allowing authenticated users to bypass permission checks and ...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

Malicious code in poly-check-b (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...

MAL-2026-16407 Malicious code in poly-check-b (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks

Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw,CVE-2026-93616 , allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point releas...

Malicious Package

Overview poly-check-b is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-84301

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...

CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

EUVD-2026-84577

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-95624

The Tauri updater plugin is vulnerable to a malicious downgrade attack because the 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When this parameter is set to true , it changes the version comparator from "update must be newer" to "update...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

CVE-2026-93602

A flaw was found in rustls-webpki. The component contains faulty Certificate Revocation List CRL authority-matching logic, which incorrectly compares only the first distribution point against each CRL's issuing distribution point, ignoring others. This vulnerability allows an attacker with a...