CVE-2026-42176

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address...

EUVD-2026-28818

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address...

CVE-2026-41887

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

EUVD-2026-28804

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

CVE-2026-41887

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

EUVD-2026-28727

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix netdevice lifecycle with devicemove The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to sol...

CVE-2026-43363

CVE-2026-43363 concerns the Linux kernel x86 APIC subsystem. If, on resume from s2ram (S2/S3 wake), firmware re-enables x2APIC mode after the kernel has booted with x2APIC disabled, the system can run with x2APIC hardware but the kernel uses the xapic interface, leading to hangs. The issue is cau...

CVE-2025-71297

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: 8822b: Avoid WARNING in rtw8822bconfigtrxmode rtw8822bsetantenna can be called from userspace when the chip is powered off. In that case a WARNING is triggered in rtw8822bconfigtrxmode because trying to read the RF...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin, thingsboard...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin, thingsboard...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: conductor-fips, conductor, camunda-zeebe, thingsboard, zipkin, kafbat-ui-fips, apache-nifi-registry, nacos-docker, keycloak-config-cli, nacos, kafbat-ui...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: conductor-fips, conductor, camunda-zeebe, thingsboard, zipkin, kafbat-ui-fips, apache-nifi-registry, nacos-docker, keycloak-config-cli, nacos, kafbat-ui...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

com.bigid:app-infrastructure (3.0.0.261-release), com.github.cafaudit:caf-audit-binding-elasticsearch (>=5.0.3-1321, <=5.0.4-1329) +82 more potentially affected by CVE-2026-8149 via org.bouncycastle:bc-fips (>=2.1.0, <=2.1.1)

org.bouncycastle:bc-fips MAVEN version =2.1.0, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =5.0.3-1321, =3.1.2-822, =3.1.2-822, =3.1.2-822, =3.1.2-822, =9.6.0, =4.10.0, =4.10.0, =4.10.0, =4.10.2 and more Source cves: CVE-2026-8149 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-16624642https://vulne...

CVE-2026-42264

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser in the HTTP adapter are read via direct property access without hasOwnProperty guards, making th...

CVE-2026-42264

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser in the HTTP adapter are read via direct property access without hasOwnProperty guards, making th...

UBUNTU-CVE-2026-42264

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser in the HTTP adapter are read via direct property access without hasOwnProperty guards, making th...

SUSE CVE-2026-41684

Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid...

CVE-2026-41887: Improper Limitation of a Pathname to a Restricted Directory

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for exampl...

PT-2026-66883

Уязвимость метода config writer библиотеки Python для взаимодействия с git-репозиториями GitPython связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код...