ALPINE-CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CVE-2026-13186

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...

CVE-2026-13186 AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...

EUVD-2026-47690

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution...

EUVD-2026-47653

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187 Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

SUSE CVE-2026-16391

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

PT-2026-63400

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...

git-lfs security update

3.7.1-6 - Rebuild with new Golang 3.7.1-5 - Fix CVE-2026-39821 in vendored golang.org/x/net idna package 3.7.1-4 - Rebuild with new Golang...

GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

GHSA-7WVC-RVP7-W99X Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...

EUVD-2026-41643

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects...

GHSA-2M9V-5Q2G-58VQ Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

CVE-2026-15724

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on...

EUVD-2026-46325

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on...

CVE-2026-15724

Progress ShareFile Storage Zones Controller (SZC) vulnerable to path traversal in versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can read arbitrary files, write to arbitrary directories, or check file existence on the server filesystem. Affected component: SZC; root caus...

CVE-2026-15724 Path traversal in Progress ShareFile Storage Zones Controller (SZC)

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on...

Security Bulletin: Vulnerabilities in Apache Tomcat affect IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products

Summary Vulnerabilities in Apache Tomcat affect the product's management GUI could cause confidentiality, integrity and availability impacts. The CLI is unaffected. CVE-2025-48976 CVE-2025-48988 CVE-2025-49125 CVE-2025-53506 CVE-2025-52434 CVE-2025-55752 CVE-2025-61795. Vulnerability Details...

Security Bulletin: Vulnerability in netty-codec-http affects IBM SAN Volume Controller, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in netty-codec-http affects IBM Storage Virtualize products and could cause an integrity impact. CVE-2025-67735. Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final...