The vulnerability lies in the function (*HostMatchList).checkIP() in the file modules/hostmatcher/hostmatcher.go, and the function RedirectURL() in the file modules/auth/openid/openid.go of the Git repository management system Gitea. This vulnerability allows a hacker to disclose protected information.

The vulnerability of the HostMatchList.checkIP function in the modules/hostmatcher/hostmatcher.go file and the RedirectURL function in the modules/auth/openid/openid.go file of the Git repository management system Gitea is related to incorrect calculations. Exploiting this vulnerability could all...

The vulnerability of the endpoints /api/v1/user/starred and /api/v1/user/subscriptions of the Git repository management system Gitea, which allows a perpetrator to disclose protected information

The vulnerability of the /api/v1/user/starred and /api/v1/user/subscriptions endpoints of the Git repository management system Gitea is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

CVE-2026-47597

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module Resource Server where an unprivileged local user could cause a use-after-free through a missing self-reference guard in the map cleanup path. A successful exploit of this vulnerability might...

ROS-20261002-73-0087

The vulnerability of the ascii function in the PostgreSQL database management system is related to reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

PT-2026-104380

Name of the Vulnerable Software and Affected Versions Next.js versions 16.3.0 through 16.3.7 Description Pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. This allows an overlapping regular request to receive unauthenticated...

CVE-2026-94544: Use of Cache Containing Sensitive Information

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

ROS-20261002-73-0061

The vulnerability of the data selection evaluator in PostgreSQL database management systems is related to incorrect session duration. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

The vulnerability of the *GiteaLocalUploader.CreateReleases() function in the services/migrations/gitea Uploader.go file of the Git repository management system Gitea allows a attacker to expose protected information.

The vulnerability of the GiteaLocalUploader.CreateReleases function in the services/migrations/giteauploader.go file of the Git repository management system Gitea is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow an attacker to disclose sensiti...

Linux Distros Unpatched Vulnerability : CVE-2026-94485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

CVE-2026-94591: Use of Hard-coded Cryptographic Key

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation...

CVE-2026-47494

NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure...

Linux Distros Unpatched Vulnerability : CVE-2026-94544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without...

CVE-2026-90952: Missing Authorization

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Django vulnerabilities (USN-8848-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8848-1 advisory. Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookup...

PaperCut MF < 25.0.13 / 26.x < 26.0.5 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is prior to 25.0.13, or 26.x prior to 26.0.5. It is, therefore, affected by the following vulnerabilities: - An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of...

NVIDIA Linux GPU Display Driver (September 2026)

The NVIDIA GPU display driver software on the remote Linux host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following: - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause...

CVE-2026-47588

NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service and...

CVE-2026-94594: Insertion of Sensitive Information into Log File

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

PT-2026-104115

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

NVIDIA Windows GPU Display Driver (September 2026)

The NVIDIA GPU display driver software on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following: - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user...