CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68410

Technical details about CVE-2026-68410 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-72689

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-72689

OpenSignLabs opensignserver prior to 2.37.0 is affected by a Broken Object-Level Authorization issue. The getDocument Parse cloud function fetches documents using useMasterKey, bypassing object ACLs and returning full contract records, including sender and signer PII and a pre-signed document dow...

Malicious code in @noobaihome/amis-uni-area-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561 scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally...

CVE-2026-72579

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-55814

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55227

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-72579

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-72579 NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-72579

NASA HyperCP (main branch) contains an OS command injection vulnerability exploitable by a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov. The Source/OBPGSession.py handler parses server response headers without sanitization and forwards attacker-c...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814

Apache Ranger is affected by a flaw in its download APIs on versions

EUVD-2026-55248

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-19075

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...