CVE-2026-78577: Missing Authentication for Critical Function

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs,...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc (ALMALINUX9.2:CLSA-2025:1753801232)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753801232 advisory. - Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially...

CentOS Linux 6 [TuxCare] Security Update: spamassassin Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777548877)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777548877 advisory. - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certai...

GHSA-3Q6V-R5MR-HXV8 league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

Summary league/commonmark's GitHub Flavored Markdown Table extension registers TableStartParser as a block-start parser. While a paragraph is the active block, the core block parser calls TableStartParser::tryStart on every non-blank line. Its first action fetches the entire growing paragraph...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Devolutions Server version 2026.3.5.0 and earlier versions are affected by a missing authorization vulnerability in the gateway network scan token API . An authenticated low-privileged user can exploit this by sending a crafted API request to generate a network scan token. This allows the attacke...

EUVD-2026-89026

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

cPanelScanner

🔍 cPanel スキャナー Go で書かれた、高速でマルチスレッドの cPanel 検出ツールです。IP アドレス、CIDR レンジ、またはファイルから読み込んだターゲットリストをスキャンし、ポート 2082、2083、2087 で動作している cPanel サービスを特定します。 ✨ 機能 マルチスレッドスキャン — 同時実行数を設定可能 CIDR 対応 — サブネット全体をスキャン ファイル入力 — ファイルからターゲットを1行につき1つ読み込む 出力保存 — 検出した URL をファイルに保存 cPanel 検出 — ヘッダー、タイトル、コンテンツ、一般的なパスを確認 プログレス...

CVE-2026-100289: Missing Authorization

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

PT-2026-102669

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-55160

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

Logpresso Log4j2 Scanner 3.0.2

Logpresso Log4j2 Scanner version 3.0.2 scans archives recursively for vulnerable Log4j components, including CVE-2021-44228, and can optionally back up and remove vulnerable classes...

sentinel

Sentinel · Security Operations & Management Console Lightwe...

CVE-2026-98156

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtioring.c handles this correctly, vringusemapapi...

CVE-2026-98056

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

CLEANSTART-2026-DY58341 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the apache-nifi package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

CVE-2026-98156: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtioring.c handles this correctly, vringusemapapi...