GHSA-GGW7-9675-6V4V MantisBT has an authorization bypass in private issue monitoring

Using a crafted POST request to bugmonitoradd.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private...

MantisBT has an authorization bypass in private issue monitoring

Using a crafted POST request to bugmonitoradd.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private...

CVE-2026-8305 OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication

A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookRequest of the file extensions/bluebubbles/src/monitor.ts of the component bluebubbles Webhook. Performing a manipulation results in improper authentication. It is possible to...

CVE-2026-33361

In Meari IoT SDK image handling libmrplayer.so as observed in CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label apps = 1.8.x, baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model...

Meari IoT SDK encryption vulnerability

Meari IoT SDK is a software development kit provided by Meari Corporation, aimed at developing applications for smart devices. There are encryption-related vulnerabilities in the Meari IoT SDK. These vulnerabilities stem from the use of a predictable key derivation method to perform reversible XO...

PT-2026-39876

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description An authorization bypass exists in the private issue monitoring feature. A user with project-level access can send a crafted POST request to the 'bug monitor add.php' endpoint to...

MonitoringBench: Semi-Automated Red-Teaming for Agent Monitoring

We introduce a red-teaming methodology that exposes harder-to-catch attacks for coding-agent monitors, suggesting that current practices may under-elicit attacks and overstate monitor performance. We identify three challenges with current red-teaming. First, mode collapse in attack generation,...

CVE-2026-43388

A flaw was found in the Linux kernel's DAMON Data Access MONitor subsystem. The damoswalk function in mm/damon/core fails to clear a dangling pointer when a context is inactive and an error occurs. This issue can lead to a temporary denial of service DoS for subsequent calls to damoswalk,...

EUVD-2026-28657

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Eagerly init vgic dist/redist on vgic creation If vgicallocateprivateirqslocked fails for any odd reason, we exit kvmvgiccreate early, leaving dist-rdregions uninitialised. kvmvgicdistdestroy then comes along and walk...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

pagecache-guard 中文文档 A runtime integr...

CVE-2026-41105 Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

...

CVE-2026-41105 Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

...

CVE-2026-41105

CVE-2026-41105 affects the Azure Monitor Action Group Notification System. The issue is described as a server-side request forgery (SSRF) that allows an authorized attacker to elevate privileges over a network. Documented impact is an Elevation of Privilege (EoP) with high risk (CVSS 3.1: 8.1). C...

EUVD-2025-209728

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data...

CVE-2025-4386 Medtronic MyCareLink Patient Monitor Hardware Debug Port

Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login prompt via a UART terminal.​...

Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure Notification Service allows an authorized attacker to elevate privileges over a network...

hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin

...

org.springframework.cloud:spring-cloud-config-monitor (2.1.6.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-alibaba-nacos-config-server (0.2.2.release), org.springframework.cloud:spring-cloud-config-monitor (2.0.3.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

ai.hyacinth.framework:core-service-config-server (>=0.5.8, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (2.1.1.release) +10 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...