OpenAI Agent Breached Australian Medicare Statistics Portal

An OpenAI agent bypassed controls on Australia's Medicare statistics portal, accessed non-public data and was not reported to officials for nearly 3 months...

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included...

CVE-2026-81455

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-82157

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access...

CVE-2026-81455

Dell ThinOS 10 versions prior to SecurityAddon_2605.10.2766_T10 are susceptible to a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access can exploit this flaw to gain Unauthorized access . For remediation, users should apply the security upda...

CVE-2026-81455

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-81455

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

EUVD-2026-86397

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-82157

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access...

EUVD-2026-86394

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access...

CVE-2026-82157

Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access...

CVE-2026-82157

Dell ThinOS 10 versions prior to SecurityAddon_2605.10.2766_T10 are affected by an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access can exploit this flaw to achieve a protection mechanism bypass and gain unauthorized access . Remediation is a...

CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...

CVE-2026-48072 Docmost: Public image fileName path traversal leads to unauthorized local file read

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

CVE-2026-48072

Docmost , an open-source collaborative wiki and documentation software, is vulnerable to a path traversal flaw in versions prior to 0.80.1 . The public avatar and logo image endpoints fail to confine file path segments to the intended directory, allowing an unauthenticated attacker to traverse ou...

CVE-2026-61604

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-91160

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

CVE-2026-91133

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

CVE-2026-84302

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists

A flaw was found in the drm/xe/rtp component of the Linux kernel. This vulnerability arises from the unconditional whitelisting of Output/Availability OA registers, which is a security violation. By default, these registers could be whitelisted after system events such as probe, graphics...