EUVD-2026-72954

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

Directory Traversal

Spring Cloud Config is vulnerable to Directory Traversal. The vulnerability is due to improper restriction of configuration file access in the native environment repository, which allows an attacker to access configuration files outside the configured repository path...

RLSA-2026:64794 Low: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

CVE-2026-16004

Armoury Crate driver (ASUS) contains an exposed IOCTL with insufficient access control that allows a local user with low privileges to read and write arbitrary PCI/PCIe configuration space by crafting IOCTL requests that bypass the driver's verification. The CVSS 4.0 base score is 5.8 (MEDIUM) , ...

CVE-2026-16004

Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security...

PT-2026-88176

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

CVE-2026-86673: Use of Hard-coded Credentials

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...

PT-2026-88291

A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger th...

PT-2026-88162

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

PT-2026-86970

Name of the Vulnerable Software and Affected Versions Armoury Crate affected versions not specified Description Insufficient access control in the Armoury Crate driver exposes an IOCTL Input/Output Control mechanism. This allows a local user to bypass driver verification and perform arbitrary rea...

Security update for libvirt (important)

openSUSE security update: security update for libvirt ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21738-1 Rating: important References: bsc1274576 bsc1274946 bsc1275264 bsc1275265 bsc1275863 Cross-References: CVE-2026-18917 CVE-2026-61477...

ROS-20260908-73-0095

The vulnerability of the Submodule.config parser function in the Python library for interacting with Git repositories in GitPython is related to incorrect external management of file names or paths. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

ROS-20260908-73-0094

The vulnerability of the GitConfigParser.read function in the git/config.py module of the Python library for interacting with Git repositories in GitPython is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitra...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

Malicious Package

Overview hyper-kube-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-78043

A flaw was found in OpenVPN. The Windows Interactive Service allows local authenticated users to bypass security restrictions and load unauthorized configuration files. By crafting special paths, an attacker can manipulate the service's configuration, potentially leading to privilege escalation...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...