kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

Pentagon breach exposes Social Security numbers and military records of millions

The US government is alerting millions of people that their personal information was stolen during a breach of the Pentagon’s personnel records at the Defense Manpower Data Center DMDC. The DMDC is a central US Department of Defense DoD organization that manages personnel records, ID credentials,...

CVE-2026-103286 Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated...

EUVD-2026-90679

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated...

Security Bulletin: Multiple vulnerabilities in i18next-http-middleware affect IBM Cloud Pak System

Summary Multiple vulnerabilities in i18next-http-middleware affect IBM Cloud Pak System CVE-2026-41683, CVE-2026-41690, CVE-2026-42353. Vulnerability Details CVEID:CVE-2026-41683 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify an...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-24072 DESCRIPTION: An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of...

Security Bulletin: Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities in IBM Cloud Pak System

Summary Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities were found in Cloud Pak SystemCVE-2026-3295, CVE-2023-38375, CVE-2026-3161,CVE-2026-4418. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...

Security Bulletin: Due to use of WebSphere Application Server - Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

Security Bulletin: Due to use of VMware ESXi and vCenter, IBM Cloud Pak System is affected by multiple vulnerabilities.

Summary Vulnerabilities in VMware ESXi and vCenter affect IBM Cloud Pak System. IBM Cloud Pak System version 2.3.6.2 has addressed these vulnerabilities. Cloud Pak Sytem has updated Platform System Manager PSM and workload nodes to VMware ESXi 83U3k and VMware vCenter to VCSA 83U3k. Vulnerability...

CLEANSTART-2024-ML93442 Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89...

CLEANSTART-2024-PX18765 Use after free in File System API in Google Chrome prior to 92

Security vulnerability affects the chromium package. Use after free in File System API in Google Chrome prior to 92...

CLEANSTART-2024-AM48749 Use after free in File System API in Google Chrome prior to 101

Security vulnerability affects the chromium package. Use after free in File System API in Google Chrome prior to 101...

CLEANSTART-2024-MV82108 Insufficient policy enforcement in File System API in Google Chrome prior to 102

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome prior to 102...

CLEANSTART-2024-SW99198 Insufficient policy enforcement in File System API in Google Chrome prior to 102

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome prior to 102...

CLEANSTART-2024-DN54132 Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103

Security vulnerability affects the chromium package. Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103...

CVE-2025-41753

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

CVE-2025-41753 Path traversal in dynamically created BACnet File Objects

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

CVE-2025-41753

A path traversal vulnerability exists in dynamically created BACnet File Objects . The system fails to perform sufficient validation on the object name, which is interpreted as a file path. This allows an unauthenticated remote attacker to use relative paths to traverse outside the intended direc...

CVE-2025-41753 Path traversal in dynamically created BACnet File Objects

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

CVE-2026-80276

Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read i...