CVE-2026-85649

Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...

CVE-2026-85584

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85582

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85584

SiYuan versions before v3.8.2 are affected by a denial of service vulnerability in the publish-service Basic Auth throttle . The throttle stores failed-attempt state keyed by attacker-controlled usernames without enforcing capacity limits or eviction policies, allowing unauthenticated attackers t...

CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...

CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

EUVD-2026-71005

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or...

CVE-2026-85582

SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler . Authenticated attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite proce...

EUVD-2026-70988

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

Linux Distros Unpatched Vulnerability : CVE-2026-14199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key...

PT-2026-85632

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTH RECEIVE response buffer nvmet execute auth receive allocates the response buffer with kmalloc sized by the host-supplied AUTH RECEIVE allocation length, but the DH-HMAC-CHAP builders write only a...

The vulnerability of the match_policy_in() function in the net/netfilter/xt_policy.c module of the netfilter component of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the matchpolicyin function in the net/netfilter/xtpolicy.c module of the netfilter component of the Linux operating system is related to an incorrect order of authentication checks before syntactic analysis and canonization. Exploiting this vulnerability could allow a remote...

Linux Distros Unpatched Vulnerability : CVE-2026-80791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE...

Linux Distros Unpatched Vulnerability : CVE-2026-80832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106171 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-18329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an...