Access Control Bypass

Overview @lobehub/lobehub is a LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application. Affected versions of this package are...

EUVD-2026-3308

OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the...

ROS-20260119-7333

A vulnerability in the kvalloc function of the eventlog/acpi.c The component of the Linux kernel is related to improper control of resource identifiers. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260119-7368

A vulnerability in the nfsd4runcbwork function of the nfs4callback.c component of the Linux kernel is related to improper control of resource identifiers. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2026-1112 Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization

A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java of the component Trade Address Deletion Endpoint. Performing a manipulation of the argument ids...

PublicCMS Authorization Issue Vulnerability

PublicCMS is an open-source content management system CMS developed by PublicCMS Company in China using the Java language. Versions of PublicCMS 5.202506.d and earlier have a vulnerability related to authorization. This vulnerability stems from incorrect handling of the ids parameter in the delet...

[SECURITY] [DSA 6102-1] python-urllib3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6102-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 17, 2026 https://www.debian.org/security/faq -...

SUSE-SU-2026:0142-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260114T191543 2026-01-14T19:15:43Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-4248 CVE-2025-62690 GHSA-q66g-q98c-q454 GO-2025-4251 CVE-2025-63389 GHSA-f6mr-38g8-39rg...

CVE-2020-36926

SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique...

GHSA-MPWP-4H2M-765C Active Job - Object injection security vulnerability

Active Job vulnerability: An Active Job bug allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability...

Active Job - Object injection security vulnerability

Active Job vulnerability: An Active Job bug allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability...

CLEANSTART-2025-CN65903 Security fixes for GHSA-6v2p-p543-phr9, GHSA-qxp5-gwg8-xv66, GHSA-vvgc-356p-c3xw applied in versions: 1.5.0-r0, 1.7.0-r0

Multiple security vulnerabilities affect the vault-k8s-fips package. These issues are resolved in later releases. See references for individual GHSA details...

CVE-2020-36926

SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique...

CVE-2020-36926

SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique...

MiracleLinux 4 : java-1.7.0-openjdk-1.7.0.25-2.3.10.3.AXS4 (AXSA:2013-486:05)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-486:05 advisory. The OpenJDK runtime environment. Security issues fixed with this release: CVE-2013-1500 Unspecified vulnerability in the Java Runtime Environment JRE...

MiracleLinux 7 : liblouis-2.5.2-12.el7 (AXSA:2017-2462:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2462:02 advisory. A missing fix for one stack-based buffer overflow in findTable for CVE-2014-8184 was discovered. An attacker could cause denial of service or potentially all...

Active Job - Object injection security vulnerability

Active Job vulnerability: An Active Job bug allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability...

MiracleLinux 7 : SDL-1.2.15-15.el7 (AXSA:2019-4397:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4397:01 advisory. SDL: CVE-2019-13616 not fixed in Asianux Server 7 erratum RHSA-2019:3950 CVE-2019-14906 Tenable has extracted the preceding description block direct...

MiracleLinux 4 : firefox-52.1.0-2.0.1.AXS4 (AXSA:2017-1625:02)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2017-1625:02 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security issues fixed with this...

CVE-2020-36926 SmarterTools SmarterTrack 7922 -Information Disclosure

SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique...