Chromium: CVE-2026-13027 Use after free in FileSystem

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-39925

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access...

sentinel

Sentinel — Agentic Code & System Quality Guardian Production-...

The vulnerability of the ext4_xattr inode_dec_ref_all() function in the fs/ext4/xattr.c module of the Ext4 file system in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the ext4xattr inodedecrefall function in the fs/ext4/xattr.c module of the Ext4 file system in the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

EulerOS 2.0 SP15 : cups (EulerOS-SA-2026-2437)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local...

Critical Photon OS Security Update - PHSA-2026-5.0-90-0904

Updates of 'linux-esx' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-0904

Updates of 'linux-esx', 'linux', 'memcached' packages of Photon OS have been released...

The vulnerability of the `ksmbd_session_lookup_all()` function in the `fs/smb/server/mgmt/user_session.c` module allows a hacker to cause a service failure within the SMB kernel of the Linux operating system.

The vulnerability of the ksmbdsessionlookupall function in the fs/smb/server/mgmt/usersession.c module of the SMB server kernel in Linux operating systems is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

Photon OS 4.0: Memcached PHSA-2026-4.0-1043

An update of the memcached package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-1043. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-31928

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access...

CVE-2026-28701

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths...

CVE-2026-56414

A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or...

CVE-2026-48935

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system. Mitigation Mitigation for this issue is either not...

CVE-2026-50767

A stored cross-site scripting XSS vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message field checkinmsg...

CVE-2026-36478

An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components...

CVE-2026-47205

A flaw was found in Envoy's extauthz HTTP filter. A use-after-free vulnerability exists when processing per-route authorization overrides concurrently with rapid downstream client disconnects. This can lead to a segmentation fault and denial of service. Mitigation Mitigation for this issue is...

CVE-2026-54353 Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation

Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connectio...

GHSA-M578-W5VF-RFCM vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset...

CVE-2026-30405 vulnerabilities

Vulnerabilities for packages: kube-vip, cilium-cli...

DEBIAN-CVE-2026-53309

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlmmatchregions region comparison The local-vs-remote region comparison loop uses '=' instead of '', causing it to read one entry past the valid range of qrregions. The other loops in the same functio...