CVE-2026-93317

The buildkit software (referenced via the Moby project) is vulnerable to a flaw where an unauthenticated attacker controlling a registry or OCI-layout blob source can provide blob contents that do not match the claimed digest. This allows the resulting snapshot to be cached under the incorrect di...

CVE-2026-18718

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

Astra Linux – Vulnerability in golang-github-golang-jwt-jwt

golang-jwt is a Go implementation of JSON Web Tokens. Starting from version 3.2.0 and before versions 5.2.2 and 4.5.2, the parse.ParseUnverified function splits its argument which is untrusted data using periods. As a result, in the case of a malicious request where the Authorization header...

CVE-2026-15964-PoC

CVE-2026-15964 - Single Sign On For TNG = 2.0.0 Élévation de privilèges non authentifiée via un changement de mot de passe non vérifié dans le plugin WordPress Single Sign On For TNG. | ---|--- Gravité| Critique 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-620 Changement de mot de...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

PT-2026-106057

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...

CVE-2026-81294

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-81294 CVE-2026-81294 Authorizer 3.15.1 - Paul Ryan I am @abraxasnull. Loopback lab. The client is CVE-2026-81294-Abraxas-Labs.py. Unverified email is enough. 3.15.1 maps GitHub emails to entry.email without...

CVE-2026-104474

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

CVE-2026-104474 OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

CVE-2026-103601 CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

Release of unverified plaintext in the CCM CcmBlockCipher and DSTU 7624 CCM KCcmBlockCipher AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets th...

CVE-2026-103601 CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

Release of unverified plaintext in the CCM CcmBlockCipher and DSTU 7624 CCM KCcmBlockCipher AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets th...

PT-2026-104456

Name of the Vulnerable Software and Affected Versions OpenLiteSpeed versions prior to 1.9.3 Description A local privilege escalation issue exists in the admin/misc/lsup.sh script. The system executes unverified update packages from a directory writable by the nobody user as the root user. An...

ROS-20261002-73-0007

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0006

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0009

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0010

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2026-103472

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth oidc provider.py decodes the id token returned by the identity provider's token endpoint using jose.jwt.get unverified claim...

Linux Distros Unpatched Vulnerability : CVE-2026-93853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots...

SUSE SLES16 Security Update : perl-Authen-SASL (SUSE-SU-2026:23913-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:23913-1 advisory. This update for perl-Authen-SASL fixes the following issue: - CVE-2026-86219: replayed authentication responses accepted due to unverified...