pfSense - Arbitrary File Write

diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...

CVE-2026-76894

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-107056

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

CVE-2026-99123

A flaw was found in the Linux kernel's Virtual Sockets vsock virtio transport. Incoming packets for connecting sockets are not properly validated against their expected source address. A local, unprivileged attacker can exploit this vulnerability by sending crafted packets during connection setup...

PT-2026-132387

Name of the Vulnerable Software and Affected Versions OpenTracks version 6751 Description Insecure permissions in the io.file.importer.ImportActivity component allow unauthorized attackers to inject crafted tracking data into the user's location database by sending a specially crafted SEND messag...

EUVD-2026-113258

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

CVE-2026-107056

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

OpenTracks security vulnerability

OpenTracks version 6751 contains a security vulnerability stemming from insecure permissions in the io.file.importer.ImportActivity component. This flaw may allow unauthorized attackers to inject specially crafted tracking data into the victim’s location database via a specially designed SEND...

CVE-2026-107056

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

CVE-2026-107056: n/a: Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows…

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

CVE-2026-107056

OpenTracks version 6751 is vulnerable to a security flaw caused by insecure permissions in the io.file.importer.ImportActivity component. This vulnerability allows unauthorized attackers to inject crafted tracking data into a victim's location database by sending a specially designed SEND message...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to a high-severity flaw (SECURITY-4226 ) involving the **

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

EUVD-2026-112185

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146665)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146665 advisory. In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from...