PT-2026-61967

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

kernel security, bug fix, and enhancement update

4.18.0-553.146.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

PT-2026-61975

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61974

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61972

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description An insecure direct object reference IDOR issue exists that allows for account takeover. This occurs when an application provides direct access to objects based on user-supplied inpu...

PT-2026-61971

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw. This issue allows for SMTP hijacking, which can result in arbitrary account takeover. The impact of this...

GHSA-FFQ3-XPV3-J92Q Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Summary Type: Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key or many distinct keys takes ON² parser time. 5000 repeated a: u\n definitions take 1.1 second; 10000 → 4.5 seconds. File: src/mistune/blockparser.p...

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Summary Type: Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key or many distinct keys takes ON² parser time. 5000 repeated a: u\n definitions take 1.1 second; 10000 → 4.5 seconds. File: src/mistune/blockparser.p...

EUVD-2026-42338

Mistune blockparser: quadratic-time parsing on long lists of repeated reference-link definitions...

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...

CVE-2026-13381 VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 expose an Insecure Direct Object Reference (IDOR) in the /v1.3.0/api/files endpoint. An authenticated attacker can modify the remark parameter to enumerate, access, and delete files owned by other users, impacting confidentiality, integrity, and availability. Root...

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

CVE-2026-44585

CVE-2026-44585 affects Paymenter prior to v1.5.0. The ticket creation endpoint validates ownership of a user-supplied service identifier is not enforced, enabling an authenticated user to create tickets that reference another user’s service. Impact stated: no direct access to service contents or ...

USN-8573-1: libde265 vulnerabilities

It was discovered that libde265 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause libde265 to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2023-51792 It was discovered that libde265 did not...

USN-8573-1 libde265 vulnerabilities

It was discovered that libde265 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause libde265 to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2023-51792 It was discovered that libde265 did not...

GHSA-42H9-826W-CGV3

creationtimestamp| type| source ---|---|--- 2026-07-20 18:32:13+00:00| seen| https://gist.github.com/alon710/cdf2a5ef96b6a707eafe65a3f00899a3 2026-07-21 12:01:34+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mr5r6g7tzv2g 2026-08-12 12:01:30+00:00| seen|...

SUSE-SU-2026:22879-1 Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.34.1 fixes various security issues The following security issues were fixed: - CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/down bsc1267206. - CVE-2026-46120: ip6gre: Use cached t-net in ip6erspanchangelink...

EUVD-2026-45909

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph...

CVE-2026-63982

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress - ethy:egress - ethx:ingress mirred loop When mirred redirects to ingress from either ingress or egress the loop state from schedmirreddev array dev is lost because of 1 the packet deferral into the...