RHEL 9 : ignition (RHSA-2026:59549)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59549 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regula...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

EUVD-2026-65060

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073

Label Studio (through 1.23.0 ) has a broken access control flaw in its annotation detail endpoint. The AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() without a get_queryset override, so any annotation is retrievable by primary key. Because permissions are ...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

JLSEC-2026-1377

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Move jumplabelinit before parseearlyparam. When both CONFIGMEMALLOCPROFILING=y and CONFIGMEMALLOCPROFILINGENABLEDBYDEFAULT=y are enabled, disabling memory profiling by adding the boot parameter 'sysctl.vm.memprofiling=...

PT-2026-80987

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label studio/tasks/api.py declares queryset = Annotation.objects.all and provides no get queryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073: Authorization Bypass Through User-Controlled Key

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

Fedora 44 : perl-URI (2026-32b0d26c4c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-32b0d26c4c advisory. 5.36 - Apply Unicode NFC normalization in URI::idna nameprep so IDNA host encoding matches other clients instead of emitting a non-standard, non-round-trippi...

GHSA-MHMQ-MMQJ-2V39

creationtimestamp| type| source ---|---|--- 2026-08-21 23:00:09+00:00| seen| https://t.me/pphmHackerNews/1832 2026-08-22 00:00:26+00:00| seen| https://t.me/pphmHackerNews/1832 2026-08-23 00:00:43+00:00| seen| https://t.me/pphmHackerNews/1832...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

DEBIAN-CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-66788 Lighthouse: dockerfile build stages use end-of-life fedora 40 referenced by mutable tag

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...