CVE-2026-106566 ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

CVE-2026-106566

The ImageMagick image manipulation software is vulnerable to a policy bypass in the delegate symlink cleanup process. Due to a missing check for the MAGICK_SHRED_PASSES environment variable, a local privileged workflow can be exploited to overwrite a file with random data. This issue is fixed in ...

GO-2026-6639 Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis

Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis...

kit-policy

kit-policy A flexible, composable authorization framework for Kit, inspired by Ruby's Action Policy. TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit...

CVE-2026-89182

A flaw was found in Gitea. When an instance is configured to enforce private repositories, the post-receive hook fails to block the push option that sets a repository as public during initial creation by push. An authenticated user permitted to create repositories can exploit this issue to bypass...

kernel: dm cache policy smq: fix missing locks in invalidating cache blocks

A flaw was found in the Linux kernel's device-mapper dm cache policy, specifically within the smq module. In passthrough mode, the invalidatemapping operation lacks proper locking, allowing for concurrent access. This can lead to data races, resulting in data corruption or use-after-free issues,...

Linux Distros Unpatched Vulnerability : CVE-2026-106579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an...

Linux Distros Unpatched Vulnerability : CVE-2026-106331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin...

Linux Distros Unpatched Vulnerability : CVE-2026-106297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

PT-2026-107715

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

PT-2026-107544

Name of the Vulnerable Software and Affected Versions @backstage/plugin-search-backend versions prior to 2.1.6 @backstage/plugin-search-backend-module-elasticsearch versions prior to 1.8.7 Description An authenticated user could receive unauthorized search results when a DENY policy is applied to...

PT-2026-107586

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC affected versions not specified Description An authenticated remote attacker with administrative credentials can execute arbitrary commands as the root user on the underlying operating...

PT-2026-107716

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.1.2 Vault Enterprise versions prior to 2.1.2 Vault Enterprise versions prior to 1.21.12 Vault Enterprise versions prior to 1.20.17 Vault Enterprise versions prior to 1.19.23 Description An issue exis...

Linux Distros Unpatched Vulnerability : CVE-2026-106362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy vi...

Linux Distros Unpatched Vulnerability : CVE-2026-106381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-106396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web...

Linux Distros Unpatched Vulnerability : CVE-2026-106310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web...

Linux Distros Unpatched Vulnerability : CVE-2026-106418

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via...

Linux Distros Unpatched Vulnerability : CVE-2026-106221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin...

Linux Distros Unpatched Vulnerability : CVE-2026-106266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web...