CVE-2026-23937

A flaw was found in Zabbix. Authenticated users can exploit the Zabbix API's host.get action to extract a host's Pre-Shared Key PSK. This could lead to a loss of data integrity, as the extracted key may enable unauthorized access or modification of sensitive information...

SUSE CVE-2026-35554

A race condition in the Apache Kafka Java producer client's buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch's ByteBuffer is...

ROS-20261002-73-0144

The vulnerability of the SOGo collaborative software server relates to the lack of protective measures for the website structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...

ROS-20261001-73-0055

The vulnerability of the management server’s software for collaborative work, SOGo, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...

Rocky Linux 9 [CIQ] Security Update: bzip2 / bzip2-debuginfo / bzip2-debugsource / bzip2-devel / etc (crlsa-2025_0925)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250925 advisory. bzip2: bzip2: Data integrity error when decompressing with data integrity tests fail. CVE-2019-12900 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: bzip2 / bzip2-debuginfo / bzip2-debugsource / bzip2-devel / etc (crlsa-2025_0733)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250733 advisory. bzip2: bzip2: Data integrity error when decompressing with data integrity tests fail. CVE-2019-12900 Tenable has extracted the preceding description block directly...

CVE-2026-102140

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...

CVE-2026-102140 Kiteworks Core Insufficient Verification of Data Authenticity

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...

CVE-2026-90333

A flaw was found in the Linux kernel's device-mapper integrity dm-integrity target. This vulnerability allows an attacker with raw write access to the backing device, but without the integrity key, to bypass data integrity checks. By stamping any block with a specially crafted discard filler tag,...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

CVE-2026-103237

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237

The MISP application (versions

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

CVE-2026-103237 MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

EUVD-2026-89760

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

CVE-2026-102140: Insufficient Verification of Data Authenticity

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...

CVE-2026-103237: Authorization Bypass Through User-Controlled Key

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...