CVE-2026-101904 vulnerabilities

Vulnerabilities for packages: redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips, nextcloud-server,...

CVE-2026-101907 vulnerabilities

Vulnerabilities for packages: redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips, nextcloud-server,...

GHSA-3PQ3-5FJ3-CG6V vulnerabilities

Vulnerabilities for packages: redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips, nextcloud-server,...

GHSA-542G-H47M-68V8 vulnerabilities

Vulnerabilities for packages: redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips, nextcloud-server,...

GHSA-9FR6-4GFG-395G vulnerabilities

Vulnerabilities for packages: azurite, redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips,...

GHSA-C29M-XWM3-CM6R vulnerabilities

Vulnerabilities for packages: redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips, nextcloud-server,...

GHSA-M8M8-QJ5V-23W3 vulnerabilities

Vulnerabilities for packages: redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips, nextcloud-server,...

GHSA-MGHH-PGCX-3JJJ vulnerabilities

Vulnerabilities for packages: redisinsight, wazuh-dashboard-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, awx, commercial-gitlab-rails-ee-fips, lerna, langfuse, gitlab-rails-ce-fips, lambda-nodejs, opensearch-dashboards, langfuse-fips, opensearch-dashboards-fips, nextcloud-server,...

fennel (0.3.0), runnel (>=0.1.0a2, <=0.1.0b1) +1 more potentially affected by CVE-2026-63374 via anyio (3.0.0rc4)

anyio PYPI version 3.0.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - fennel 0.3.0 - runnel =0.1.0a2, =0.8.0, =0.13.0 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...

UBUNTU-CVE-2026-97904

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

CVE-2026-97904

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

SUSE CVE-2026-73292

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

SUSE CVE-2026-73293

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

SUSE CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...

fennel (0.3.0), runnel (>=0.1.0a2, <=0.1.0b1) +1 more potentially affected by CVE-2026-64847 via anyio (3.0.0rc4)

anyio PYPI version 3.0.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - fennel 0.3.0 - runnel =0.1.0a2, =0.8.0, =0.13.0 Source cves: CVE-2026-64847 Source advisory: OSV:GHSA-5P39-CFHJ-2XMP...

SUSE CVE-2026-91994

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-91994

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-91994

Semaphore UI through 2.19.12 contains a missing authorization vulnerability in the GetMustCanMiddleware component. The middleware exempts GET and HEAD requests from project resource permission checks, allowing attackers with guest or task_runner roles to read all project environments—including pl...

CVE-2026-91994 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

EUVD-2026-78434

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...