CVE-2026-95835: Missing Authorization

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Octavia vulnerabilities (USN-8814-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8814-1 advisory. It was discovered that Octavia did not properly validate TLS cipher string fields in the Amphora provider driver. An authenticate...

F5 Networks BIG-IP : BIG-IP APM vulnerability (K000162605)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5.0.41.14-ENG.iso / 17.1.3.6 / 17.5.1.10 / 21.1.0.3 / Hotfix-BIGIP / Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso / Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso. It is, therefore, affected by a vulnerability as referenced in the...

Linux Distros Unpatched Vulnerability : CVE-2026-95835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtai...

openSUSE 16: mcphost / mcphost-bash-completion / mcphost-fish-completion / etc (openSUSE-SU-2026:21886-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21886-1 advisory. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case o...

openSUSE 16 Security Update : distribution (openSUSE-SU-2026:21898-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21898-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the...

Mattermost Server 10.11.x < 10.11.23 / 11.7.x < 11.7.8 / 11.8.x < 11.8.5 / 11.9.x < 11.9.1 Incorrect Authorization (MMSA-2026-00702)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00702 advisory. - Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to sanitize Team objects returned by the data retention team...

Configurable Storage Parameter Store Etcd RBAC Disclosure

The vulnerability of the RBAC authorization verification mechanism when processing configuration store transactions involving Etcd is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected by this...

CVE-2026-53626: Authorization Bypass Through User-Controlled Key

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to...

PT-2026-98944

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An authorization bypass allows an authenticated agent to read knowledge base answer content without proper authorization. The issue exists in a GraphQL mutation used to transform knowledge base answer...

Adobe Experience Manager Forms JEE <= 6.5.25 / 6.5 LTS SP2 Multiple Vulnerabilities (APSB26-151)

The version of Adobe Experience Manager Forms JEE installed on the remote host is 6.5.25 or earlier, or 6.5 LTS SP2 or earlier. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-151 advisory. - Adobe Experience Manager Forms JEE is affected by an Incorrect...

PT-2026-99018

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...

PT-2026-98916

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description An incomplete fix in the MQTT topic permission handling allows a low-privileg...

CVE-2026-66078: Missing Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

PT-2026-98926

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.18 RabbitMQ versions 4.0.x prior to 4.0.24 RabbitMQ versions 4.1.x prior to 4.1.15 RabbitMQ versions 4.2.x prior to 4.2.10 RabbitMQ versions 4.3.x prior to 4.3.5 Description RabbitMQ Management renders an...

CVE-2026-61837: Improper Authorization

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...

CVE-2026-67407: Missing Authorization

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

CVE-2026-67421: Missing Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

CVE-2026-67411: Incorrect Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

Linux Distros Unpatched Vulnerability : CVE-2026-67421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP...