PT-2026-71802

Name of the Vulnerable Software and Affected Versions IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 IBM Storage Scale versions 6.0.0.0 through 6.0.1.0 Description The GUI contains a hardcoded token within the source code. This token is utilized for inter-node cluster communication and for...

CVE-2026-13460: Use of Hard-coded Credentials

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

PT-2026-71912

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-73610: Authorization Bypass Through User-Controlled Key

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document...

PT-2026-71868

Name of the Vulnerable Software and Affected Versions IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 IBM Storage Scale versions 6.0.0.0 through 6.0.1.0 Description Sensitive information may be exposed within the log files of the IBM Storage Scale Management GUI. Specifically, the administrato...

CVE-2026-19483: Insertion of Sensitive Information into Log File

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...

Linux Distros Unpatched Vulnerability : CVE-2026-63299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify...

CVE-2026-14663: Cleartext Storage in a File or on Disk

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

Linux Distros Unpatched Vulnerability : CVE-2026-14663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL versi...

Linux Distros Unpatched Vulnerability : CVE-2026-19730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt...

PT-2026-71461

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description The shared storage used by product components is architected without sufficient access separation. This allows processes sharing the storage to access or modify files beyond their intended...

EUVD-2026-57605

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt...

EUVD-2026-39535

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access...

CVE-2026-63299

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...

EUVD-2026-57418

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...

CVE-2026-63299

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...

CVE-2026-73308

Budibase CVE-2026-73308 affects the server-side automation handling prior to version 3.39.25. The issue arises in packages/server/src/api/controllers/automation.ts (and testProgress.ts) where automation test results exposed trigger.outputs.user.oauth2 and were broadcast to the app room without pr...

Cleartext Storage of Sensitive Information

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the Variable deserialization. An attacker can access sensiti...

Cleartext Storage of Sensitive Information

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the Rendered Templates UI when the var.json fails to mask...

CVE-2026-73290

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...