CVE-2026-55678 Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled is true but cluster.sharedsecret is not configured. The defaults in internal/config/config.go set...

CVE-2026-82272

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

SUSE CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

EUVD-2026-67831

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

CVE-2026-82280 Quivr Prompt Endpoints Missing Ownership Validation

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users...

CVE-2026-82280 Quivr Prompt Endpoints Missing Ownership Validation

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users...

EUVD-2026-67811

Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users...

CVE-2026-82272

Immich versions up to 3.1.0 contain a visibility enforcement flaw: when an asset is locked via the single-asset endpoint , the lock is not correctly applied to shared albums and shared links , allowing a low-privileged attacker to read the asset and its metadata without bypassing any other protec...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

EUVD-2026-67803

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Copilot Chat Microsoft Edge allows an authorized attacker to disclose information over a network...

CVE-2025-32463

Exploit CVE-2025-32463 Panoramica Questo repository fornisce un tool di exploit basato su Go per CVE-2025-32463 , una vulnerabilità critica di escalation dei privilegi locali CVSS 9.3 nelle versioni di sudo 1.9.14 fino a 1.9.17. Consente a utenti locali non autorizzati di ottenere accesso root...

CVE-2026-82237

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...

WordPress Shared Files Pro plugin < 1.7.68 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files Pro versions 1.7.68...

WordPress Shared Files plugin < 1.7.67 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files versions 1.7.67...

SUSE-SU-2026:23356-1 Security update for gzip

This update for gzip fixes the following issues: - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state between different decompression formats within a single execution bsc1269623. - Crafted LZW file followed by a crafted LZH file can...

WordPress Shared Files plugin < 1.7.67 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files versions 1.7.67...

WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files Pro versions 1.7.70...