BIT-TOMCAT-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, fr...

BIT-TOMCAT-2025-66614 Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions...

SUSE CVE-2026-19583

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

CLEANSTART-2026-OB74177 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

Multiple security vulnerabilities affect the spring-boot package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...

EUVD-2026-75879

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

PT-2026-90378

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free flaw exists in the NFSD client teardown process. The destroy client function releases a client's open owners, but a lock owner whose only reference is a blocked lock...

PT-2026-90349

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the coalesce t2 function computes data pointers using server-supplied DataOffset fields without validating them against buffer bounds. A small...

PT-2026-96560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse buf ptr reparse buf ptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparse data buffer u8 io + off; len =...

PT-2026-90367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the handle session function when decoding MDSCapAuth records within a CEPH SESSION OPEN message. The function uses ceph decode copy to read the match.path...

PT-2026-96517

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlink data error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlink data" compared the post-ALIGN length against the remaining...

PT-2026-90374

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel during the cleanup of revoked states in NFSv4.0. The function nfs40 clean admin revoked takes a stateid reference while holding the clp-...

PT-2026-90364

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel's Ceph implementation where the ceph parse deleg inos function fails to validate the value of the len variable when decoding interval sets of delegate...

PT-2026-90346

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the data offset bound in the is valid oplock break function was incorrectly calculated. A change intended to remove the RFC1002 header from smb hd...

ROS-20260911-73-0033

The vulnerability of the Network component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

PT-2026-89798

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

PT-2026-89873

An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...

PT-2026-90353

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free and buffer leak exists in the SMB client within the cifs check trans2 function. This occurs when a valid primary TRANSACT2 response is received, but a subsequent seconda...

ROS-20260911-73-0057

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0193

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

ROS-20260911-73-0047

The vulnerability of the Bluetooth components in Google Chrome and Microsoft Edge browsers is related to the implementation of security features at the client side. Exploiting this vulnerability allows a malicious actor to cause service interruptions through a specially created HTML page...