CVE-2026-101004

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

EUVD-2026-88090

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004: Missing Authentication for Critical Function

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

PT-2026-99769

Name of the Vulnerable Software and Affected Versions NotionNext versions 4.1.0 through 4.10.10 Description An issue exists in the Authentication Guard component within the cleanCache function of the pages/api/cache.js file. Remote manipulation of the token argument can lead to a complete bypass ...

CVE-2026-102279: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-81655: Improper Control of Generation of Code

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fixed the zerocopy completion for multi-skbs sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned use...

CVE-2026-93364

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

EUVD-2026-87207

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-93364

Bludit CMS versions through 3.22.0 are vulnerable to a mass assignment vulnerability within the Pages::edit() function located in bl-kernel/pages.class.php. The root cause is that the application iterates through all fields declared in dbFields without implementing per-field authorization. This a...

CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

DEBIAN-CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

AZL-104421 CVE-2026-97954 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

UBUNTU-CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-98106

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference...

EUVD-2026-86808

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...