CVE-2026-89693

A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. This vulnerability arises from improper error handling within the nfsd4create function, which is responsible for creating files and directories. When Access Control Lists ACLs are translated, any errors are silently...

CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Aviso de seguridad: El contrabando de solicitudes HTTP permite eludir el control de acceso del front-end rouille ID de CVE asignado: CVE-2026-67182 Resumen rouille::proxy::proxy y rouille::proxy::fullproxy copian los valores de las cabeceras de solicitud proporcionados por el cliente a la conexió...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

BIT-TOMCAT-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0 through 9.0.120. Th...

EUVD-2026-75780

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

CVE-2026-88008

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching...

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...

CVE-2026-88884

A flaw was found in Renovate, a dependency update automation tool. This vulnerability allows for the bypass of the minimumReleaseAge security control when processing digest updates. A remote attacker could exploit this by publishing a malicious dependency version, which Renovate would then...

CVE-2026-22012-Diameter-Protocol-Credit-Control-Bypass-in-5G

CVE-2026-22012 – 5G 中的 Diameter 协议 Credit‑Control 绕过 程序代码（Python Diameter 模拟） root@kitploit: diametercreditcontrolsim.py - Simulated OCS with missing final-unit indication class OCS: def processCCRself, request: Vulnerability: always returns SUCCESS with same quota, never sends final-unit return...

CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV Distributed Authoring and Versioning user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Executive Summary This report details two critical security vulnerabilities discovered in the feiskyer/mcp-kubernetes-server package. When deployed, the server exposes an MCP tool named kubectl which is intended to provide limited, safe access...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2021-40346

CVE-2021-40346 请求头内部表示中的整数溢出允许 HTTP 请求走私。本仓库提供了一个使用 docker-compose 构建的 PoC，包含两个 docker 镜像：一个运行存在漏洞版本的 HaProxy（本例中为 2.2.16），另一个运行使用 Gunicorn 作为 WSGI 的 Flask Web 服务器。通过利用该漏洞，我们能够访问 /admin 页面，而该页面的请求本会被 HaProxy 通过用户自定义规则阻止。 POC 环境要求 Docker 🐳 Docker compose 🐳 环境配置 HaProxy docker 容器，端口 8000 映射到宿主机。...

PT-2026-89736

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

CVE-2026-25890-FileBrowser-Access-Control-Bypass

CVE-2026-25890 - FileBrowser 访问控制绕过 未认证用户无法利用此漏洞——需要有效的低权限凭据，且该凭据被限制访问目标路径。 FileBrowser ≤ v2.57.0 中基于路径的授权绕过，利用多个前导斜杠（//private 而非 /private）来规避 strings.HasPrefix 检查，而文件系统仍会提供规范化路径。 已在 v2.57.1 中修复（提交 489af403... – 移除了 ）。...

CVE-2026-21962

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server Proxy Plug-in Bypass de Control de Acceso mediante Inconsistencia en la Normalización de URI Un exploit y análisis reproducidos de forma independiente para CVE-2026-21962 control de acceso inadecuado, CVSS 10.0 en Oracle HTTP Server / el Proxy...