CVE-2026-102846: Improper Authorization

A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument...

CentOS Linux 8 [TuxCare] Security Update: perl / perl-Attribute-Handlers / perl-Devel-Peek / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1776788664)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1776788664 advisory. - CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. CVE-2023-31484 - HTTP::Tiny...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1783791996)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1783791996 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP request...

CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS-STREAM8:CLSA-2026:1782317620)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1782317620 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1768395381)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1768395381 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the...

CentOS Linux 7 [TuxCare] Security Update: perl / perl-CPAN / perl-ExtUtils-CBuilder / perl-ExtUtils-Embed / etc (CENTOS7:CLSA-2026:1778758473)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778758473 advisory. - HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where user...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS6:CLSA-2026:1786464575)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1786464575 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

AlmaLinux 9.6 [TuxCare] Security Update: opensc (ALMALINUX9.6:CLSA-2026:1781088266)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781088266 advisory. - OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the dokeyvalue function in...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the PyEnvCfg.write method in src/virtualenv/create/pyenvcfg.py, where configuration values containing line boundary characters such as \n, \r, \v, \f, and Unicode line/paragraph separators are written into pyvenv.cfg...

CVE-2026-91191

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-81841

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

AZL-105672 CVE-2026-102938 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938

The virtualenv tool, used for creating isolated Python environments, is vulnerable to configuration injection in versions prior to 21.7.11 . The root cause is that PyEnvCfg.write() writes prompt values verbatim to the pyvenv.cfg format, while PyEnvCfg._read_values() parses this file using str.spl...

CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-81841 Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

CVE-2026-81841 Paused shared dashboard access tokens still expose data source configuration

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

CVE-2026-81841

A vulnerability exists in Grafana where pausing a shared (public) dashboard fails to revoke its access token for endpoints serving frontend bootstrap data. This missing authorization allows anyone with the link to a paused dashboard to retrieve the configuration of its data sources without authen...