Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...

Rocky Linux 9.6 [CIQ] Security Update: expat / expat-devel (ciqsa-2026_1548)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261548 advisory. This advisory aggregates security fixes for the expat SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-93990. Tenable has extracted the preceding description blo...

AlmaLinux 9.6 [TuxCare] Security Update: grafana-pcp (ALMALINUX9.6:CLSA-2026:1777445847)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777445847 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Rocky Linux 9.6 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc (ALMALINUX9.6:CLSA-2026:1786720807)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786720807 advisory. - An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the...

CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

ansible-lint-26.9.0-1.1 on GA media (moderate)

ansible-lint-26.9.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11856-1 Rating: moderate Cross-References: CVE-2026-32274 CVSS scores: CVE-2026-32274 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2026-32274 SUSE : 6.8...

EUVD-2026-87214

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...

CVE-2026-93477

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

EUVD-2026-86550

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477

The ash-project ash framework is vulnerable to an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability. In versions 2.17.15 before 3.33.11 , the Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 functions fail to verify ...

EEF-CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Summary Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by...

CVE-2026-93477: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

Overview Cinnamon's Kotaemon all versions up to v0.12.0 multi‑user chat interface does not verify conversation ownership when loading a conversation. Any authenticated user can read, delete, rename, or overwrite another user’s conversation data by supplying the correct ID. This results in...

CVE-2026-87264

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Integration Broker. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-79745

MCPHub is a unified hub for centrally managing and orchestrating multiple MCP servers/APIs. Prior to version 1.0.32 , the built-in prompt and resource controllers perform no role checking — the mutating POST/PUT routes for /api/prompts* and /api/resources* are attached to the authenticated router...

CVE-2026-79745: Missing Authorization

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...