PT-2026-83170

Name of the Vulnerable Software and Affected Versions Hatchet versions 0.40.0 through 0.91.0 Description The Dispatcher gRPC service fails to verify if a request's worker ID belongs to the tenant identified by the bearer-token context. This occurs within the Dispatcher/UpsertWorkerLabels and...

NimbusPWN-CVE-2022-29799-29800

🛡️ NimbusPWN-CVE-2022-29799-29800 – Testen lokaler Privilegienausweitungs-Sicherheitslücken 📖 Über dieses Werkzeug Diese Software hilft Sicherheitsforschern, zwei spezifische Schwachstellen zu untersuchen, die als CVE-2022-29799 und CVE-2022-29800 bekannt sind. Diese Fehler existieren in der...

CVE-2026-30056

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via supplying crafted NGAP messages during the initialization of a new RAN connection...

CVE-2026-30056

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 (an open-source 5G Core implementation) allows a remote attacker to trigger a Denial of Service by supplying crafted NGAP messages during the initialization of a new RAN connection. The vulnerability is rated CVSS 7...

EUVD-2026-67107

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via supplying crafted NGAP messages during the initialization of a new RAN connection...

CVE-2026-30056

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via supplying crafted NGAP messages during the initialization of a new RAN connection...

NetworkManager security update

1.40.16-21.0.1 - Add support for DADCONFLICT to nm-dispatcher - Drop 777 permissions from Networkmanager-dispatcher drop-in directory Orabug: 37581862 - Add a dropin file to make Networkmanager-dispatcher persistent Orabug: 36989910 - disable MPTCP handling by default Orabug: 35081472 - Fix...

NetworkManager security update

1.54.3-5.0.1 - Introduce always-ignore-carrier setting Orabug: 39663315 - disable MPTCP handling by default Orabug: 34801142 - add connectivity check via Oracle servers Orabug: 32051972 - Add a dropin file to make Networkmanager-dispatcher persistent Orabug: 36989910 - Drop 777 permissions from t...

EUVD-2026-62693

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21...

CVE-2026-19198

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher , allowing a low-privileged authenticated user to perform unauthorized bulk actions. The vulnerability is network-exploitable with low attack complexity and no user interaction, re...

CVE-2026-19198 Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21...

CVE-2026-19198 Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch

Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21...

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-75627

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

EUVD-2026-60578

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75627

Bastillion's controller dispatcher (BaseKontroller.java) fails to validate request URI paths, allowing unauthenticated attackers to bypass authentication filters by prefixing arbitrary path segments. This grants access to administrative controllers to read user listings, create manager accounts, ...