PT-2026-56923

Name of the Vulnerable Software and Affected Versions Proximus b-box version v8c.725A Description Incorrect access control allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules. Recommendations At the moment, there is no information about...

Oracle Linux 9 : openssl (ELSA-2026-50379)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50379 advisory. 3.5.5-4.0.1fips - Replace upstream references in fips man pages Orabug: 35824276 - Update additional upstream references - Add FIPS package change: ad...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21262-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21262-1 advisory. Changes in hauler: - update to 2.0.1 bsc1269433, CVE-2026-48702: bump go to 1.26.4 to squash CVE noise Full v2 Release notes:...

CVE-2026-5923 Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack

Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage...

CVE-2026-57481 Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber'...

CVE-2026-57481

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber'...

CVE-2026-13151

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-60125

CVE-2026-60125 affects MISP: the importModule() path used getEnabledModule() to resolve a module by name, but did not enforce per-organisation restrictions implemented by getEnabledModules(). This can allow an authenticated user from an organisation not allowed to use a restricted module (Plugin....

CVE-2026-57242

The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash...

CVE-2026-57242

Technical details are not publicly available in the provided documents for CVE-2026-57242; monitor Foxit security bulletins for updates on affected products, versions, impact, and remediation.

CVE-2026-57242

The application opens the PDF, and JavaScript modifies the form. However, the related objects on the page lack complete lifecycle management and null value validation; when the page state changes, the application continuously dereferences invalid objects, eventually leading to a crash...

EUVD-2026-42196

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application...

The vulnerability of the Picomatch library lies in the uncontrolled modification of object prototype attributes, which allows attackers to compromise data integrity.

The vulnerability of the Picomatch library is related to uncontrolled changes to the attributes of the object’s prototype. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

PT-2026-56660

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions 0.0.0 through 4.0.4 Ray Enterprise Translation versions 4.1.0 through 4.1.4 Ray Enterprise Translation versions 11.0.0 through 11.0.4 Description Cross-Site Request Forgery CSRF occurs when a module fails to...

kernel security, bug fix, and enhancement update

5.14.0-687.22.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Cross-site Request Forgery (CSRF)

Overview ha-mcp is a Home Assistant MCP Server - Complete control of Home Assistant through MCP Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the exposed api/settings routes when accessed at the bare root path without authentication. An attacker can modify...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

mcp-kubernetes-server has a Command Injection vulnerability

mcp-kubernetes-server does not correctly enforce the --disable-write / --disable-delete protections when commands are chained. The server only inspects the first token to decide whether an operation is write/delete, which allows a read-like command to be followed by a write action using shell...

Missing ratelimit on passwrod resets in zenml

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...

ESPHome vulnerable to Authentication bypass via Cross site request forgery

SummaryAPI endpoints in dashboard component of ESPHome version 2023.12.9 command line installation are vulnerable to Cross-Site Request Forgery CSRF allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files create, edit,...