CVE-2026-83538

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are affected by a Missing Authorization vulnerability. The root cause is that several helper endpoints within the Human Resources, Catalog, and Order Manager applications are configured to skip authentication and perform no permission c...

CVE-2026-83538 Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human...

CVE-2026-81038 Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BTGATTOTSOACPPROCCHECKSUMCALC, regardless o...

ROS-20261026-73-0096

The vulnerability in openssh is related to the lack of validation during the processing of incoming requests. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the system...

Wolfvision Cynap authorization issue vulnerability

The Wolfvision Cynap has an authorization issue vulnerability. This vulnerability stems from access control problems in the web server configuration. Certain resources intended for local use on devices can be accessed remotely by attackers who lack authentication but possess a web interface; this...

K000163833: Linux kernel vulnerability CVE-2026-46114

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMICWRITE payloads atomicwritereply at drivers/infiniband/sw/rxe/rxeresp.c unconditionally dereferences 8 bytes at payloadaddrpkt: value = u64 payloadaddrpkt; checkrkey...

Astra Linux – vulnerability in exim4

Exim DNSDB Out-of-Bounds Read Information Disclosure Vulnerability. This vulnerability enables network-adjacent attackers to disclose sensitive information on affected Exim installations. No authentication is required to exploit this vulnerability. The specific flaw resides in the SMTP service,...

PT-2026-96994

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE affected versions not specified Description The management interface contains a flaw that allows an unauthenticated remote attacker to disclose sensitive information. By sending specially crafted requests to...

PT-2026-96163

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0 Description Tinyauth exposes a timing difference during authentication attempts that allows a remote observer to distinguish between existing and nonexistent local usernames. This occurs because the loginHandle...

CVE-2026-54629

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...

CVE-2026-73496

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...

Astra Linux – Vulnerability in atftp

In AtFTP, before version 0.7.5, the options.c file contained code that read past the end of an array. As a result, server-side /etc/group data was disclosed to a remote client...

Astra Linux – Vulnerability in FLAC

In FLACbitreaderreadricesignedblock of bitreader.c, there is a potential out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure without requiring additional execution privileges. User interaction is required for exploitation. Product: Android. Versions:...

CVE-2026-19357

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and...

CVE-2026-48145

A flaw was found in Apache Thrift C++ bindings. This vulnerability, caused by improper validation of certificates with host mismatch, could allow a remote attacker to disclose sensitive information. Mitigation To mitigate this issue, restrict network access to systems utilizing Apache Thrift C++...

EUVD-2026-53708

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-18995

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-18995 netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-18974

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...

ROS-20260806-73-0025

The vulnerability of the l2capconnect function in the net/bluetooth/l2capcore.c module of the Linux kernel is related to insufficiently secure data encryption. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by this function...