The vulnerability of the `add_stack_record_to_list()` function in the `mm/page_owner.c` file of the Linux kernel’s memory management subsystem allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the addstackrecordtolist function in the mm/pageowner.c file of the Linux kernel’s memory management subsystem is related to the execution of a loop with an unreachable exit condition „Infinite loop“. Exploiting this vulnerability could allow an attacker to compromise the...

PT-2026-66607

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The software fails to perform ownership or session checks when looking up sequential orderId...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Improper Access Control (SERVER-127689)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, or 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSession...

Linux Distros Unpatched Vulnerability : CVE-2026-68562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When a...

PT-2026-66459

Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...

PT-2026-66503

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description An LDAP injection issue exists where the ActiveDirectoryGroupRealm constructs LDAP search filters without escaping user-controlled input. This allows an authenticated attacker to inject...

Devolutions Server 2026.1.x < 2026.1.24.0 / 2026.2.x < 2026.2.14.0 Multiple Vulnerabilities (DEVO-2026-0026)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.23.0 or 2026.2.4.0 through 2026.2.12.0. It is, therefore, affected by multiple vulnerabilities, including: - Improper access control in the role membership management endpoint in Devolutions Server allows a...

Linux Distros Unpatched Vulnerability : CVE-2026-14643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no- cache or private Cache-Control directive. In undici...

The vulnerability of the me2600_xilinx_download() function in the drivers/comedi/drivers/me_daq.c module, which supports devices for collecting data from Linux operating systems. This vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the me2600xilinxdownload function in the drivers/comedi/drivers/medaq.c module, which supports devices for collecting data from Linux operating systems, is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiti...

The vulnerability of the loopback_check_format() function in the sound/drivers/aloop.c module of the Linux kernel’s audio subsystem allows a hacker to access protected information or cause service failures.

The vulnerability of the loopbackcheckformat function in the sound/drivers/aloop.c module of the Linux kernel’s audio subsystem is related to the repeated use of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker to gain access to...

PT-2026-66614

Name of the Vulnerable Software and Affected Versions ansible-collection-redhat-leapp affected versions not specified Description A flaw exists when a remediation task is executed with elevated privileges and the leapp old postgresql data option is selected. This results in the creation of a...

PT-2026-66655

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret key base and often credentials for external systems, whic...

PT-2026-66573

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0 Description Authenticated users with edit work packages permissions, but lacking manage file links permissions, can manipulate file links via the 'PATCH /api/v3/work packages/id' endpoint. By using the...

Interpretation Conflict

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing...

Interpretation Conflict

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...

axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If...

Security Bulletin: consul-mcp-server vulnerable to server side request forgery leading to token exposure

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic...

CVE-2026-67439

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...