SUSE CVE-2026-74419

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copytouser The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits...

PT-2026-85200

Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-85310

🚨 HIGH: CVE-2026-69857 CVSS 8.5 - Authorization bypass in Azure Cosmos DB allows authenticated attackers to perform spoofing over network. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/jpe1VOsLLc...

Oracle Linux 8 : ELSA-2026-61248-0: / libxml2 (ELSA-2026-612480)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-612480 advisory. 2.9.7-21.7 - Fix CVE-2026-11979 RHEL-215569 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

PT-2026-85083

A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate method only performed semantic validation when the supplied definition was...

Beyond the Trust Boundary: A Critical Reassessment of the FIDO2 Threat Model

FIDO2/WebAuthn has been widely deployed as a phishing-resistant authentication scheme. Because FIDO2 relies on public-key cryptography and hardware-backed authenticators, its security is often assumed to be guaranteed by design, provided that the cryptographic implementation is correct. In this...

Linux Distros Unpatched Vulnerability : CVE-2026-78409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That...

PT-2026-85314

Name of the Vulnerable Software and Affected Versions Microsoft Azure Active Directory B2C affected versions not specified Description An authorization bypass exists in cloud identity deployments supporting public-facing authentication flows. This issue occurs due to a user-controlled key, which...

PT-2026-84933

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn component where the system fails to verify if a socket is owned by ovpn before dereferencing sk user data. Certain subsystems, such as BPF SOCKMAP, may set sk...

CVE-2026-78595: Missing Authorization

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

PT-2026-85142

Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5...

CVE-2026-84836: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-75035: Authorization Bypass Through User-Controlled Key

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

CVE-2026-85226: Missing Authorization

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

PT-2026-84975

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with operator privileges can perform a SQL injection by manipulating the selected grp dupli parameter within the ID field. This occurs due ...

PT-2026-91015

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import filtering opts host restrictions. An authenticated user...

PT-2026-84972

Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...

PT-2026-84917

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

PT-2026-85049

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate...

PT-2026-85055

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's username and principalIds fields. A user holding the update verb on users.management.cattle.io could inject a foreign identity provider principal into any account, so that the next log...