CVE-2026-72812

SiYuan has a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint for versions before v3.7.4. The issue allows anonymous readers to trigger persistent server-side writes by supplying an attacker-controlled block ID, which can flush transaction queues, scan all references g...

CVE-2026-19016

A flaw was found in Consul. An authenticated caller with network access to the Consul server RPC port could bypass authorization checks. This vulnerability occurs because the system did not enforce the session:write Access Control List ACL permission for session deletion operations submitted...

CVE-2026-18709

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709 Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

EUVD-2026-56883

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709

CVE-2026-18709 concerns MongoDB Server: an authenticated user with direct network access to a shard can improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination. The underlying root cause is described as inadequate authorization around the pr...

PT-2026-70862

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-19016

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-72731

Discourse vulnerability CVE-2026-72731 affects 2026.1.0-latest through 2026.8.0-latest.1, including the Data Explorer query path and plugin data_explorer code, where parameterized Data Explorer queries could be crafted to escape the intended query via non-recursive and recursive parameter interpo...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Unconditionally sets set-nelems before inserting an element. In the event that the set is full, a new element is inserted and then removed without waiting for the RCU grace period. Meanwhile, the RCU reader m...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: Fixed an issue where uninitialized waitqueues were present in the transaction manager. The initialization of the transaction manager in txInit did not properly initialize TxBlock0.waitor, resulting in a crash when txEnd0 is...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed a deadlock in waitcurrenttrans due to an ignored transaction type When waitcurrenttrans is called during starttransaction, it currently waits for a blocked transaction without considering whether the given transactio...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Do not log conflicting inodes if it’s a directory that was moved during the current transaction. We cannot log an conflicting inode if it’s a directory that was moved from one parent directory to another parent directory...

Linux Distros Unpatched Vulnerability : CVE-2026-19016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted...

CVE-2026-52878

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped o...

CVE-2026-52878 Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped o...

CVE-2026-52878

CVE-2026-52878 affects Klever-Go (versions 1.7.14–1.7.17). A nil RawData sub-message in protobuf Transaction triggers a nil-pointer panic when txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without a nil check, causing a crash in the libp2p pubsub/the node process. The crash prop...

Security Bulletin: Authorization bypass for session deletion in the transaction API

Summary Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary...