CVE-2026-56728 Zammad: Cross-User Taskbar Item Access Control Vulnerability

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with the target user's taskbar identifier. T...

CVE-2026-56731 Zammad: Cross-Site Scripting in Ticket Notifications

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization...

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability. Authenticated users can bypass collection-level permissions by directly accessing the client-upload route , allowing them to upload files without the required permissions and circumv...

MGASA-2026-0453 Updated udisks2 package fixes a security vulnerability

Local privilege escalation via as-user option spoofing. CVE-2026-7867...

Updated udisks2 package fixes a security vulnerability

Local privilege escalation via as-user option spoofing. CVE-2026-7867...

CVE-2026-91837

A flaw in NetworkManager-iodine , the iodine VPN plugin for NetworkManager, allows a local unprivileged user to achieve local privilege escalation . The vulnerability exists because the application incorrectly processes the 'nameserver' setting during the establishment of an iodine VPN connection...

BIT-GITLAB-2026-86341 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

BIT-GITLAB-2026-82837 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to...

BIT-GITLAB-2026-8030 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

BIT-GITLAB-2026-78252 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

BIT-GITLAB-2026-12910 Missing Authentication for Critical Function in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing...

BIT-JUPYTERLAB-2026-73627 JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

AZL-104417 CVE-2026-98022 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: cap txqueuelen at S16MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-txqueuelen with no upper bound. An unprivileged user via unshare -Urn can set a huge txqueuelen and exhaust...

DEBIAN-CVE-2026-98022

In the Linux kernel, the following vulnerability has been resolved: net: cap txqueuelen at S16MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-txqueuelen with no upper bound. An unprivileged user via unshare -Urn can set a huge txqueuelen and exhaust...

CVE-2026-97597

In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6flowlabelget allocates an ipv6flsocklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease...

CVE-2026-69148

A flaw was found in MLflow, an open-source AI engineering platform. Insufficient validation in the CreateModelVersion function allows an authenticated user to create a model version that references another user's artifact directory. This enables the authenticated user to read files from that...

CVE-2026-98063 bpf: Fix NULL-ptr-deref in btf_var_show()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf renders against - since base BTF ...

EUVD-2026-86675

In the Linux kernel, the following vulnerability has been resolved: net: cap txqueuelen at S16MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-txqueuelen with no upper bound. An unprivileged user via unshare -Urn can set a huge txqueuelen and exhaust...

CVE-2026-98022

The Linux kernel contains a vulnerability where several subsystems (pfifo_fast , tun , and tap ) allocate ring buffers based on dev->tx_queue_len without an upper bound. An unprivileged user using unshare -Urn can set an excessively large tx_queue_len to exhaust global memory via oversized rin...

CVE-2026-98022 net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations

In the Linux kernel, the following vulnerability has been resolved: net: cap txqueuelen at S16MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-txqueuelen with no upper bound. An unprivileged user via unshare -Urn can set a huge txqueuelen and exhaust...