ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

OmniSec-Hex

🛡️ OmniSec-Hex OmniSec-Hex は、6つの強力なクライアントサイドセキュリティおよびソブリンインテリジェンスワークバンクを統合した、高度でインパクトの大きいサイバーセキュリティモノレポです。完全なデータロックダウンを備えたブラウザローカルメモリ環境内で完全に動作し、このエコシステムはモバイルトリアージ、動的Webテスト、低レベルバイナリ分析、ニューラル脅威マッピングにわたるクロスバーティカル分析機能を提供します。 🧰 6つのコアモジュール 📱 1. Anvil Mobile Labs 役割: モバイルセキュリティトリアージ & リパッケージエンジン 機能: iOS...

firefox: thunderbird: Mitigation bypass in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Remote Settings Client component...

firefox: thunderbird: Sandbox escape in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...

CVE-2026-93354: Initialization of a Resource with an Insecure Default

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

UBUNTU-CVE-2026-93801

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

Linux Distros Unpatched Vulnerability : CVE-2026-93801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong valu...

Linux Distros Unpatched Vulnerability : CVE-2026-93794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio ...

CVE-2026-96747

The client-side field level encryption support in the MongoDB Python D...

CVE-2026-93801

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

Linux Distros Unpatched Vulnerability : CVE-2026-66072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw...

UBUNTU-CVE-2026-96747

The client-side field level encryption support in the MongoDB Python D...

MiracleLinux 8 : freerdp-2.11.7-13.el8_10 (AXSA:2026-1901:30)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1901:30 advisory. FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway CVE-2026-55193 Tenable has extracted the preceding description block directl...

Linux Distros Unpatched Vulnerability : CVE-2026-93542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses in libXi before 1.8.4 could be used by malicous servers to crash the X client...

Linux Distros Unpatched Vulnerability : CVE-2026-67231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verifyfun that...

kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps

A flaw was found in the libceph component of the Linux kernel. A remote attacker could send a specially crafted monitor map monmap that advertises zero monitors. This malformed monmap is incorrectly processed as valid, which can lead to a client crash when attempting to open a session. This...

CVE-2026-67231

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verifyfun that overrides badcert, unknownca / badcert, selfsignedpeer when the presented cert "matches" a whitelisted one. The match key is extractissuerid/...

DEBIAN-CVE-2026-67231

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verifyfun that overrides badcert, unknownca / badcert, selfsignedpeer when the presented cert "matches" a whitelisted one. The match key is extractissuerid/...

CVE-2026-66072

A flaw was found in RabbitMQ. An authenticated stream client with read access to any stream can exploit a vulnerability in the getchunkselector/1 function. This function processes a client-supplied chunkselector property without proper validation, leading to an atom table exhaustion. Successful...

CVE-2026-67231

RabbitMQ (messaging and streaming broker) is vulnerable to a TLS client-authentication bypass in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. When the trust-store plugin is enabled and used as the verify_fun, the system improperly validates certificates by matching only the Issuer...