CVE-2026-44231

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231

CVE-2026-44231 affects RT REST 2.0: a privileged (non-administrative) user can obtain authentication credentials belonging to other users (including admins) and use them to read data via RT’s feed endpoints. The same request that exposes credentials also rotates them, invalidating existing feed U...

CVE-2026-44229

CVE-2026-44229 (RT) affects the Request Tracker project: versions 5.0.0 and 6.0.0 and above, up to but not including 5.0.10 and 6.0.3, contain an XSS vulnerability where uploaded content is served inline instead of as an attachment. An authenticated user who can upload content can inject JavaScri...

CVE-2026-44228

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44228 RT: Stored Cross-Site Scripting via insufficient template escaping

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44228

RT: Stored Cross-Site Scripting in versions 6.0.0–6.0.2 due to insufficient HTML escaping; an authenticated user with data‑setting permissions can inject JavaScript executed by other RT users. Fixed in 6.0.3. Affected product details, root cause, and fix are documented across CVE and NVD entries;...

CVE-2026-44227

RT (Rocket Tickets) is affected in versions 6.0.0 and above up to, but not including, 6.0.3, where a reflected XSS vulnerability exists in URL parameters. An attacker who can lure an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user’s browser session, with...

MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerability ...

MAL-2026-10138 Malicious code in uac-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d2c2d224834611b638d571689ba89e7ad9b15f59f68a01f403056d02c9278c9 On npm install, [email protected] runs postinstall.js which calls integrate to silently modify the installer's own source tree without prompt or...

Malicious code in uac-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d2c2d224834611b638d571689ba89e7ad9b15f59f68a01f403056d02c9278c9 On npm install, [email protected] runs postinstall.js which calls integrate to silently modify the installer's own source tree without prompt or...

Security update for transmission (moderate)

openSUSE Security Update: Security update for transmission Announcement ID: openSUSE-SU-2026:0237-1 Rating: moderate References: 1267404 Cross-References: CVE-2026-38978 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...

Linux Distros Unpatched Vulnerability : CVE-2026-55192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Update to 3.27.1 It fixes CVE-2026-55191, CVE-2026-55192, CVE-2026-55193, CVE-2026-55194, CVE-2026-55648 and CVE-2026-55827. CVE-2026-55192 Note that Nessus...

USN-8506-1 request-tracker5 vulnerabilities

Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search "Page" URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. CVE-2026-6841 It was discovered that Request Tracker did not properly sanitize user-...

Debian dsa-6381 : ata-modules-6.12.90+deb13-armmp-di - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6381 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6381-1 [email protected] https://www.debian.org/securit...

[SECURITY] [DSA 6381-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6381-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 05, 2026 https://www.debian.org/security/faq -...

[SECURITY] [DSA 6379-1] bird3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6379-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2026 https://www.debian.org/security/faq -...

SUSE-SU-2026:2713-1 Security update for tracker

This update for tracker fixes the following issues: - CVE-2026-1765: heap buffer overflow vulnerability in extracttxxxtags bsc1257607. - CVE-2026-1766: heap buffer overflow vulnerability in getid3v23tags bsc1257608...

CVE-2026-57081 Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input

Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches captu...

CVE-2026-50739

A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the tracker-campaigns.php script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to...

CVE-2026-50739

Revive Adserver 6.0.7 and earlier expose a bypass of ownership validation in the reverse operation that links campaigns and trackers via tracker-campaigns.php. A low-privilege user could link their trackers to campaigns owned by other managers on the same instance, causing inconsistent ownership ...