CVE-2026-100418: Exposure of Sensitive Information to an Unauthorized Actor

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

PT-2026-98656

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the vhost-vdpa component of the Linux kernel. The function vhost vdpa config cb loads the config ctx variable and signals it without holding a lock or...

PT-2026-98657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vhost-vdpa component where the vhost vdpa set config call function swaps the return value of eventfd ctx fdget into v-config ctx before validating it. If the...

SUSE CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

CVE-2026-63645

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field...

CVE-2026-63645 OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field...

CVE-2026-63645 OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field...

CVE-2026-63645

Versions of OpenObserve prior to 0.90.3 are vulnerable to an information disclosure flaw where the /config/runtime endpoint is accessible without authentication. The application fails to properly filter sensitive fields, such as meta_postgres_dsn , meta_postgres_ro_dsn , meta_ddl_dsn , and usage_...

CVE-2026-63645 OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field...

DEBIAN-CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

AZL-103940 CVE-2026-93206 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

UBUNTU-CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

CVE-2026-93824 tls: reject the combination of TLS and sockmap

In the Linux kernel, the following vulnerability has been resolved: tls: reject the combination of TLS and sockmap TLS and sockmap BPF psock integration hides a lot of latent bugs. Bugs which may be more or less relevant for real users but they are definitely exploitable. We could not find anyone...

CVE-2026-93206 PCI/proc: Use file_ns_capable() when checking config space read access

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

EUVD-2026-85935

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

Malicious code in eslint-config-compact-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b index.js executes on module load and collects host reconnaissance data — os.platform, os.hostname, os.userInfo.username, architecture, Node version,...

MAL-2026-17157 Malicious code in eslint-config-compact-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b index.js executes on module load and collects host reconnaissance data — os.platform, os.hostname, os.userInfo.username, architecture, Node version,...

CVE-2026-96898

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument pathtype results in path traversal. It is possible to launch the atta...