CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...

CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

kontext-cli v1.3.0

Website | Documentation | Dashboard | Discord Stop risky AI-agent actions before they run AI agents do more than suggest code. They run shell commands, read files, call services, change infrastructure, and interact with production systems. Kontext puts local policy between AI agents and the tools...

CLEANSTART-2026-QE70350 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the tekton-chains-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See referenc...

SUSE CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

Jupyterlab Python Library < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73626)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The detected version of the JupyterLab Python package is prior to 4.5.10, or 4.6.x prior to 4.6.2. It is, therefore, affected by a vulnerability: - JupyterLab contains a...

CVE-2026-84841

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841

tsi-coop tsi-dpdp-cms versions up to 0.5.0 contain a flaw where server-side security is enforced only on the client side , allowing a remote, unauthenticated attacker to bypass authentication via direct HTTP requests. The exploit has been published as a proof-of-concept (see exploit repository )....

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

EUVD-2026-70255

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84841 tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

EUVD-2026-61222

fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count...

CVE-2026-78600 Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention

Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read...

CVE-2026-78600 Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention

Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read...

EUVD-2026-69945

Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing: from n/a through 6.1.1...

CVE-2026-84841: Client-Side Enforcement of Server-Side Security

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

Oracle Linux 9 : ELSA-2026-60304-0: / golang (ELSA-2026-603040)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-603040 advisory. 1.26.7-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.7-1 - Update to Go 1.26.7 fips-1 - Resolves: RHEL-246425 1.26.5-2 - Update t...