CVE-2026-84458

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-63204 Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...

CVE-2026-92161 FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

Security update for gnome-shell

This update for gnome-shell fixes the following issue: CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE-SU-2026:4350-1 Security update for gnome-shell

This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619...

EUVD-2026-86475

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

PT-2026-98894

Name of the Vulnerable Software and Affected Versions FriendsOfFlarum OAuth versions prior to 1.7.4 FriendsOfFlarum OAuth versions prior to 2.0.0-beta.4 Description An account takeover issue exists when the Discord OAuth provider is enabled. The provider fails to check the verified field of the...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Octavia vulnerabilities (USN-8814-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8814-1 advisory. It was discovered that Octavia did not properly validate TLS cipher string fields in the Amphora provider driver. An authenticate...

CVE-2026-97636

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636

The apache-airflow-providers-hashicorp component is vulnerable to a team-scope guard bypass in the HashiCorp Vault secrets backend . In multi-team deployments, a Dag author can provide a Variable key containing a path separator . This causes the backend to fall back to a team-agnostic path, allow...

CVE-2026-97636

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-94606

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611

The open-source identity provider authentik is vulnerable to unauthorized credential exposure in versions prior to 2026.2.7 , 2026.5.7 , and 2026.8.2 . The authentik API serializers incorrectly return stored credentials when a user possesses view permission on an affected configuration, even if t...

EUVD-2026-86277

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...