CVE-2026-72539: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-73215: Uncontrolled Resource Consumption

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...

CVE-2026-73214: Uncontrolled Resource Consumption

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtlsserverinputhandler and createnewconnectedudpsocket in src/apps/relay/dtlslistener.c retain OpenSSL dtls1reassemblefragment state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before...

CVE-2026-62910: Improper Control of Resource Identifiers

Improper control of resource identifiers 'resource injection' in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-71217: Improper Input Validation

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

Important: resource-agents security update

The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability HA environment. Security Fixes: pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values...

Security Updates for Microsoft Exchange Server (August 2026)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper control of resource identifiers 'resource injection' in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a...

PT-2026-81157

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description A server-side request forgery SSRF occurs when an HTTP proxy is configured. The nltk.pathsec.urlopen function and its callers nltk.data.load and nltk.downloader.Downloader.index/download validates the...

Linux Distros Unpatched Vulnerability : CVE-2026-68321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: txgbe: fix FDIR filter leak on remove Perfect FDIR filters can be added while the interface is down and are kept on the software list for later restore...

Linux Distros Unpatched Vulnerability : CVE-2026-68091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes...

CVE-2026-59137: Use of Uninitialized Resource

Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally...

CVE-2026-11811

The UpdateHub over-the-air update client's startcoapclient in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret 0 flag, but ret was set to -1 immediately after the socket was...

CVE-2026-11811 Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS

The UpdateHub over-the-air update client's startcoapclient in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret 0 flag, but ret was set to -1 immediately after the socket was...

CVE-2026-11811

The UpdateHub over-the-air update client's startcoapclient in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret 0 flag, but ret was set to -1 immediately after the socket was...

CVE-2026-11811

The CVE-2026-11811 entry documents a socket-file-descriptor leak in the UpdateHub OTA client (start_coap_client) when connection-setup fails. The leak occurs because on failure paths the cleanup gate does not call cleanup_connection(), leaving an open descriptor in the global ctx.sock that is ove...

CVE-2026-11811 Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS

The UpdateHub over-the-air update client's startcoapclient in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret 0 flag, but ret was set to -1 immediately after the socket was...

CVE-2026-11811 Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS

The UpdateHub over-the-air update client's startcoapclient in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret 0 flag, but ret was set to -1 immediately after the socket was...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Cloud installation tool (cloudkit) are now fixed in 5.2.3.8 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the cloud deployment installation tool cloudkit could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.8 or higher and 6.0.1.1. Vulnerability Details CVEID:CVE-2026-29181 DESCRIPTION:...

CVE-2026-16456

A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to rea...

CVE-2026-72914

Mastodon prior to versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 exposes a resource exhaustion risk via administrative statistics endpoints (Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController). Anonymous callers can pass keys, start_at, and end_at to trigger long-running...