Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-py (UTSA-2026-093196)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093196 advisory. A denial of service via regular expression in the py.path.svnwc component of py aka python-py through 1.9.0 could be used by attackers to cause a compute-time denial...

CVE-2026-79126

Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially obtain sensitive information via crafted network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux, Linux 5.10

A memory overflow vulnerability was discovered in the ipc functionality of the memcg subsystem in the Linux kernel. This vulnerability occurs when a user calls the semget function multiple times, thereby creating semaphores. This flaw allows a local user to deplete resources, resulting in a denia...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5 . The flaw resides in the external PDF viewer used to display the application manual and its interaction with the underlying Windows operating system . An...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

CVE-2026-19683

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways . During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel . An attacker with visibility or control of the relevant network path can obtain ...

CVE-2026-64968

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-64971

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

CVE-2026-64971 Reflected XSS in ATutor

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

CVE-2026-64971

ATutor's restore functionality allows reflected XSS: a crafted URL triggers arbitrary JavaScript execution in the victim's browser. Only version 2.2.4 is confirmed vulnerable, but the product is no longer actively supported and has no fix, so other versions may also be affected. CVSS 4.0 base sco...

CVE-2026-64971 Reflected XSS in ATutor

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

EUVD-2026-63372

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

CVE-2026-64968

ATutor's import functionalities allow an authenticated administrator to perform Server-Side Request Forgery, reaching arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// when PHP URL wrappers are enabled. The product is no longer supported and remains unpatched;...

EUVD-2026-63369

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-64968 Server-Side Request Forgery in ATutor

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-71879

GBIF Integrated Publishing Toolkit versions before 3.3.4 leave initial setup functionality unauthenticated until first reboot, allowing remote authenticated attackers to bypass authentication and gain administrative control. CVSS 4.0 scores it 9.1 CRITICAL (network, low complexity, no privileges ...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...