CVE-2026-91881

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

CVE-2026-76113

Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfishcertificate resource component. A high privileged attacker with remote access could potentially exploit this vulnerability, leading...

CVE-2026-87093 MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-87093

Progress MOVEit Transfer is affected by an Incorrect Permission Assignment for Critical Resource vulnerability (CWE-732). The issue stems from a MOVEit Transfer service directory being writable by local users, which enables Local Privilege Escalation . Affected versions include those before 2025....

CVE-2026-110658 Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

CVE-2026-53613

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy "mount2" path is used without "/proc", restricted non-root "mount" requests validate an "/etc/fstab" target before the mount operation re-resolves that...

EUVD-2026-101095

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. ...

CVE-2026-25946

The Gitea platform contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability within its OpenID authentication functionality. The root cause is located in the SignInOpenID() function of the routers/web/auth/openid.go file, where the application accepts a user-supplied openid_url...

CVE-2026-35161

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-110618

The SmsForwarder application (versions through 3.5.0 ) is vulnerable to a missing authentication flaw within its AndServer HTTP server . This vulnerability allows unauthenticated network attackers to invoke remote-control APIs. Successful exploitation enables attackers to read SMS messages , call...

CVE-2020-37281

Gravitee API Management versions through 4.12.22 are vulnerable to an authentication bypass caused by the use of a default JWT secret (CWE-1394). An unauthenticated remote attacker who knows an existing user ID can forge an HS256 token signed with the shipped default secret. By presenting this fo...

CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37281 Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2026-35161

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-101217

Dell Unisphere for PowerMax vApp versions 9.2.4.x are susceptible to a Path Traversal vulnerability (CWE-22). A low privileged attacker with remote access could exploit this flaw to cause Information disclosure . No specific exploit code or in-the-wild exploitation details are provided in the doc...

DEBIAN-CVE-2026-109968

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...

CVE-2026-109968

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...

CVE-2026-109968

A vulnerability exists in the clevis PKCS#11 pin , where the clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. Because the log file is created without restrictive permissions, it is world-readable under the default process umask, allowing ...

EUVD-2026-101021

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...

CVE-2026-109968 Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...