CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

PT-2026-82220

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

PT-2026-82330

Name of the Vulnerable Software and Affected Versions HCL BigFix Quantum Risk Analyzer affected versions not specified Description The software generates highly detailed logging information by default. This behavior increases the risk of sensitive data leakage and may allow an attacker to gain...

CVE-2026-75329: Missing Authentication for Critical Function

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

GitLab 18.9 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-18252)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with...

CVE-2026-65956: Missing Authentication for Critical Function

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2026-75329

The super-diamond-server software (versions

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75338

The disconf (Distributed Configuration Management Platform) version 2.6.36 is vulnerable to Incorrect Access Control . The root cause is that the LoginInterceptor explicitly whitelists four specific config-fetching API endpoints: /api/config/item, /api/config/file, /api/config/list, and /api/conf...

PT-2026-82320

Name of the Vulnerable Software and Affected Versions super-diamond-server versions prior to 1.3.4 Description The Netty configuration distribution service on port 8283 lacks an authentication mechanism. This allows an attacker to retrieve the complete configuration of any project, which may...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-55228: Authorization Bypass Through User-Controlled Key

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-81032: Missing Authentication for Critical Function

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

CVE-2026-75338: Improper Access Control

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: trousers (UTSA-2026-093151)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093151 advisory. An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openssh (UTSA-2026-104810)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104810 advisory. In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. Tenable has extracted the preceding...

ALSA-2026:60004 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098834)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098834 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TC...