MINI-JV49-7998-F4CF

Bulletin has no description...

MINI-R7XF-5936-9CH2

Bulletin has no description...

MINI-PRMQ-FGHF-69FM

Bulletin has no description...

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

Summary The API Platform serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. Impact An attacker who can submit write requests...

CVE-2026-64584

Summary (CVE-2026-64584): Linux kernel usb gadget f_midi vulnerability. The f_midi driver’s work item (midi->work) can be dereferenced after the midi object is freed because cancellation is not performed by f_midi_disable()/f_midi_unbind(), allowing a use-after-free if a concurrent userspace w...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS does not escape user-controlled field values in a JavaScript context. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission.As of publication of...

CVE-2026-67863

A flaw was found in open62541. A server-side use-after-free vulnerability exists in the local MonitoredItem callback path. This occurs when the system attempts to use a notification object after it has been deallocated. A remote attacker can exploit this vulnerability to cause a denial of service...

EUVD-2026-53680

An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling...

EUVD-2026-53671

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UASubscriptionlocalPublish continues to use the current UANotification after a callback invokes UAServerdeleteMonitoredItem for the current local MonitoredItem. This allows a...

PT-2026-68417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the f midi driver. The driver uses a work item midi-work handled by the f midi in work function, which dereferences the f midi structure. This work is...

CVE-2026-67872: Uncontrolled Resource Consumption

An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling...

DEBIAN-CVE-2026-67863

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UASubscriptionlocalPublish continues to use the current UANotification after a callback invokes UAServerdeleteMonitoredItem for the current local MonitoredItem. This allows a...

MINI-72MC-7CXM-F8P7

Bulletin has no description...

MINI-M997-Q826-4WW3

Bulletin has no description...

MINI-FG38-Q79H-375X

Bulletin has no description...

CVE-2026-70442

Jenkins Google Chat Notification Plugin 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

CVE-2026-70440

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-70441

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...