CVE-2026-79776 rclone before 1.75.0 Authentication Bypass via pprof

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

CVE-2026-79776: Exposure of Sensitive Information to an Unauthorized Actor

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

CVE-2026-77357: Uncontrolled Resource Consumption

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

PT-2026-81365

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

PT-2026-81850

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

The vulnerability of the read_key_from_user_keying() function in the kernel/crash_dump_dm_crypt.c module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the readkeyfromuserkeying function in the kernel module crashdumpdmcrypt.c of the Linux operating system is related to the inclusion of proprietary information in the debugging code. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: accel/amdxdna: Use callerclient for debugging BO sync. amdxdnadrmsyncboioctl looks up args-handle in the drmfile of the ioctl caller. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Nullifies the cq-dbg pointer in mlx5debugcqRemove Before this patch, if mlx5CoreDestroyCq failed, the destruction operations continued. However, mlx5CoreDestroyCq could be called again by the user, causing additional...

CLSA-2026-1787562139 TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.3-tuxcare.2...

laravel-access-control-lab

laravel-access-control-lab A deliberately vulnerable Larave...

CVE-2026-48050

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...

EUVD-2026-64190

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...

CVE-2026-48050 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...

SUSE CVE-2026-65959

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. A local user could exploit a boundary error in the debug address watch v2 functionality by providing a specially crafted watchid. This could lead to a buffer overflow, potentially allowing memory access outside of...

kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. A local user could exploit a boundary error in the debug address watch v2 functionality by providing a specially crafted watchid. This could lead to a buffer overflow, potentially allowing memory access outside of...

EUVD-2026-62940

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

EUVD-2026-62939

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

JetBrains IntelliJ IDEA < 2026.2.1 Multiple Vulnerabilities

The version of JetBrains IntelliJ IDEA installed on the remote host is prior to 2026.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains IntelliJ IDEA before 2026.2.1 RCE via Markdown export tool was possible. CVE-2026-75056 - In JetBrains IntelliJ IDEA before 2026.2.1 SSR...

CVE-2026-76374

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...