CVE-2026-90942 Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

EUVD-2026-77710

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-82437

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82437

The Apache Storm Logviewer suffers from a flaw where log access controls are not enforced for daemon logs. Specifically, the system incorrectly discards authorizer results when a "this is a daemon log" flag is set, and certain endpoints reach handlers without consulting an authorizer. This allows...

EUVD-2026-77451

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

CVE-2026-90933 laradashboard through 1.2.2 Missing Authorization via License API

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usbnet: gl620a: fixed the endpoint checking in genelinkbind Syzbot reports a warning in usbsubmiturb triggered by inconsistencies between expected and actual endpoints in the gl620a driver. Since genelinkbind does not properly...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k – Verify that the expected usbendpoints are present. This bug occurs when a USB device claims to be an ATH9K device, but it does not have the expected endpoints. In this case, there was an interrupt endpoint, and the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Video: fbdev: amba-clcd: Fixed refcount leak issues. In clcdfbofinitdisplay, we should call ofnodeput for the references returned by ofgraphgetnextendpoint and ofgraphgetremoteportparent, as these references have increased the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xhci: Device endpoints are removed from the bandwidth list when the device is freed. Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed. If the xHCI host is dying or bein...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fixed incomplete endpoint checking While vmk80xx does have endpoint checking implemented, some issues may still go unnoticed. Depending on the hardware model, URBs can have either bulk or interrupt types, and the...

Astra Linux - Vulnerability in linux-5.10, linux-5.15, linux-6.1, linux

In the Linux kernel, the following vulnerability has been resolved: sr9800: Add a check for usbnetgetendpoints Add a check for usbnetgetendpoints and return an error if it fails in order to propagate the error...

CVE-2026-14344

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory I...

WordPress BE REST Endpoints plugin <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation vulnerability

Unauthenticated Stored XSS and Widget Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin BE REST Endpoints versions = 1.0.0...

PT-2026-91756

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text,...

Linux Distros Unpatched Vulnerability : CVE-2026-72709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to...

FreeBSD : Gitea -- multiple vulnerabilities (fac18f5f-afc2-11f1-8266-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fac18f5f-afc2-11f1-8266-3c7c3fba4204 advisory. Gitea reports: This release contains fixes for 26 security issues, hardens issue searching tha...

PT-2026-91714

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation affected versions not specified Description Improper validation of HTTP headers allows a remote attacker to bypass authorization and invoke restricted endpoints. Recommendations At the moment, there is no...

PT-2026-91209

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...