CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

PT-2026-98290

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-93354: Initialization of a Resource with an Insecure Default

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

Linux Distros Unpatched Vulnerability : CVE-2026-97149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method,...

CVE-2026-97409: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...

PT-2026-98459

Name of the Vulnerable Software and Affected Versions OpenStack Swift affected versions not specified Description An issue exists in the s3api middleware where truncated aws-chunked PUT request bodies are handled incorrectly. An authenticated attacker can exploit this behavior to cause the system...

Linux Distros Unpatched Vulnerability : CVE-2026-97409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules...

PT-2026-97862

Name of the Vulnerable Software and Affected Versions Termix versions 2.5.0 through 2.5.0 Description Authenticated users can configure webhook or ntfy notification channels using destination URLs controlled by an attacker. By using the notification-channel test endpoint, an attacker can trigger...

CVE-2026-79760: Server-Side Request Forgery (SSRF)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

Linux Distros Unpatched Vulnerability : CVE-2026-78383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leadin...

Linux Distros Unpatched Vulnerability : CVE-2026-77756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header...

Linux Distros Unpatched Vulnerability : CVE-2026-66070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed...

PT-2026-98127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt component where the tb-root switch is not properly set to NULL when a domain is stopped. This failure to clear the root switch prevents the tb xdp hand...

PT-2026-97923

Name of the Vulnerable Software and Affected Versions Termix versions 2.4.1 through 2.5.0 Description An authenticated administrator can execute arbitrary operating-system commands as the backend process. This occurs because the application fails to properly sanitize domain and email values store...

Linux Distros Unpatched Vulnerability : CVE-2026-78437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This...

CVE-2026-97409

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...

Linux Distros Unpatched Vulnerability : CVE-2026-86350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libevent (UTSA-2026-124537)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124537 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124475)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124475 advisory. When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips...

ALSA-2026:71543 Important: cockpit-image-builder security update

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fixes: fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri:...