ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

Exploit for CVE-2026-74586

CVE-2026-74586 — SCTP ASCONF newtransport use-after-free trig...

GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...

DEBIAN-CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

UBUNTU-CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678 Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw in FreeIPA 's idp-add command allows insufficiently validated --organization/--base-url input to reach a constrained eval() call before the corresponding LDAP access control check is enforced. Any authenticated IPA principal, regardless of privilege level, can enumerate and read environmen...

EUVD-2026-72357

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678 Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

WordPress Unlimited Elements For Elementor plugin <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter vulnerability

Reflected Cross-Site Scripting via 'formDataid' Parameter vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.17...

CVE-2026-79678: Improper Neutralization of Directives in Dynamically Evaluated Code

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-86234: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86235: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/postransac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may...

CVE-2026-79678: Improper Neutralization of Directives in Dynamically Evaluated Code

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...