CVE-2026-55164: Plaintext Storage of a Password

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101970 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroupstoragegetnextkey listnextentry never returns NULL -- whe...

PT-2026-76992

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A mitigation bypass...

CVE-2026-74959: Protection Mechanism Failure

Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

Linux Distros Unpatched Vulnerability : CVE-2026-74305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 bpf: Fix oob access in cgroup local storage is still incomplete. The...

PT-2026-76953

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229...

PT-2026-77225

Name of the Vulnerable Software and Affected Versions Submariner operator affected versions not specified Description A flaw exists in the Submariner operator where the Submariner Custom Resource CR, used for network connectivity configuration, stores the IPsec pre-shared key PSK in an unencrypte...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

EUVD-2026-60479

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-71424 Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

s3dns v0.2.26

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

SUSE CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

Security Bulletin: IBM Storage Defender - Data Protect critical vulnerabilities resolved in Release Defender 2.2.1/Data Protect 7.4.1

Summary IBM Storage Defender: Data Protect critical vulnerabilities resolved in release Defender 2.2.1/Data Protect 7.4.1. The vulnerabilities have been addressed in Data Protect 7.4.1, which is included in IBM Storage Defender 2.2.1 Vulnerability Details CVEID:CVE-2020-14343 DESCRIPTION: A...

CVE-2026-75057

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

CVE-2026-75057

In IntelliJ IDEA before 2026.1.5, Git credentials were written in plaintext to the IDE log, exposing them to any local user with log read access. CVSS 6.2 (MEDIUM) reflects high confidentiality impact. Exploitation details are not provided; upgrade to 2026.1.5 to remediate.

Security Bulletin: Improper input validation, integer overflow, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to improper input validation, integer overflow, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message pars...

CVE-2026-16138

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host...

CVE-2026-16139

In Progress ShareFile Storage Zones Controller versions = 5.12.5 and = 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote...

CVE-2026-16137

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result...

CVE-2026-16137 Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result...