CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098698 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvmetcphandler2t to ensure it's...

RHEL 8 : freerdp (RHSA-2026:60173)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60173 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098970 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Refactor bind path to use free After an bind/unbind cycle, the ncm-notifyreq i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098789)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098789 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE...

Linux Distros Unpatched Vulnerability : CVE-2026-34964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098907)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098907 advisory. In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but doe...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75332

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-7487: Access Control Check Implemented After Asset is Accessed

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-75329: Missing Authentication for Critical Function

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control due to a flaw in the JiMuMDCCommonsRequestLoggingFilter.java component. The application improperly uses the userid from the request header as the primary mechanism for identity verification. This allows an attacker to forge user identity cr...

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control vulnerability. A remote attacker can send a specially crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , leading to unauthorized modification of user data. To mitigate thi...

CVE-2026-75332

Zyplayer-Doc versions 1.0.0 and earlier are vulnerable to Server-Side Request Forgery (SSRF) . This flaw exists in the WikiPageWebService.download() function, which can be leveraged by an attacker to induce the server to make requests to unintended locations. While no patched version is currently...

SUSE SLES15 Security Update : grafana (SUSE-SU-2026:3718-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3718-1 advisory. grafana updated from version 11.6.14+security04 to version 12.4.5: Security fixes: - CVE-2026-39882: Prevent memory exhaustion DoS in...

CVE-2025-61162: Improper Access Control

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2026-77573: Time-of-check Time-of-use (TOCTOU) Race Condition

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

PT-2026-82292

This is a classic "roundup" post. Since the summary is generic "top threats you should know about" and the source is a vendor F5, I need to assume this is a curated list of multiple events. I will treat this as Scenario A Technical Threat but structure it as a digest of multiple items, pulling fr...