CVE-2026-1007

The Devolutions Server is affected by an incorrect authorization vulnerability in its virtual gateway component (versions 2025.3.1 through 2025.3.12 ). This flaw allows attackers to bypass deny IP rules . To remediate this issue, users should update the Devolutions Server to a version later than ...

CVE-2026-1007

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12...

CVE-2026-1007

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12...

CVE-2026-1007

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12...

PT-2026-3442

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.1 through 2025.3.12 Description An incorrect authorization issue exists in the virtual gateway component of Devolutions Server. This allows attackers to bypass deny IP rules. Recommendations Update Devolution...

CVE-2026-1007: Incorrect Authorization

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12...

MiracleLinux 4 : bind-9.8.2-0.68.1.0.1.rc1.AXS4 (AXSA:2018-3319:03)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3319:03 advisory. bind: processing of certain records when deny-answer-aliases is in use may trigger an assert leading to a denial of service CVE-2018-5740 Tenable has extract...

MiracleLinux 7 : bind-9.9.4-61.1.0.1.el7.AXS7 (AXSA:2018-3317:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3317:03 advisory. bind: processing of certain records when deny-answer-aliases is in use may trigger an assert leading to a denial of service CVE-2018-5740 Tenable has extract...

MiracleLinux 4 : httpd-2.2.15-60.6.0.1.AXS4 (AXSA:2017-2391:05)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2391:05 advisory. A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in a...

PT-2026-2732

CVE-2026-20927 Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB Server allows an authorized attacker to deny service over a… https://t.co/CyK7T10c3m...

CVE-2023-25812

Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a Deny policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header X-Amz-Bypass-Governance-Retention: true. However, this was...

RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

Summary A flawed denyonly short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Details akin to...

GHSA-XGR5-QC6W-VCG9 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

Summary A flawed denyonly short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Details akin to...

CVE-2026-22043 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed denyonly short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privilege...

CVE-2026-22043 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed denyonly short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privilege...

PT-2026-2144

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78 Description RustFS is a distributed object storage system built in Rust. A flaw in the deny only short-circuit within RustFS IAM allows a restricted service account or STS credential to...

Picklescan has Incomplete List of Disallowed Inputs

Summary Currently picklescanner only blocks some specific functions of the pydoc and operator modules. Attackers can use other functions within these allowed modules to go through undetected and achieve RCE on the final user. Particularly pydoc.locate: Can dynamically resolve and import arbitrary...

PT-2026-50451

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.33 Description An incomplete deny-list fails to block the pydoc.locate and operator.methodcaller functions. This allows remote attackers to bypass security checks by crafting malicious pickle files. The...

SUSE CVE-2023-54086

In the Linux kernel, the following vulnerability has been resolved: bpf: Add preemptcountsub,add into btf id deny list The recursion check in bpfprogenter and bpfprogexit leave preemptcountsub,add unprotected. When attaching trampoline to them we get panic as follows, 867.843050 BUG: TASK stack...

EUVD-2023-60359

In the Linux kernel, the following vulnerability has been resolved: bpf: Add preemptcountsub,add into btf id deny list The recursion check in bpfprogenter and bpfprogexit leave preemptcountsub,add unprotected. When attaching trampoline to them we get panic as follows, 867.843050 BUG: TASK stack...