CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

EUVD-2026-84205

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

PT-2026-96260

Name of the Vulnerable Software and Affected Versions x-ui version 0.3.2 Description An improper access control issue allows any authenticated panel user to modify the xray configuration template via the settings interface. By triggering a panel restart, the xray management gRPC service Google...

CVE-2026-79317: Insufficient Session Expiration

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

PT-2026-104827

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients...

CVE-2026-88807: Heap-based Buffer Overflow

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2 . An authenticated panel user can modify the xray configuration template via the settings interface and trigger a panel restart. This action causes the xray management gRPC service —which defaults to a loopback binding—to be regenerate...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2 because the full user object is stored in a client-side signed cookie . The application's authentication mechanism only verifies that a user object can be retrieved from the cookie without re-validating against the database or checking a session ve...

CVE-2026-63329: Improper Encoding or Escaping of Output

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

The vulnerability of the golang-x-image package, a programming language, allows attackers to trigger a service failure.

The vulnerability of the golang-x-image package, a programming language, is related to unlimited resource distribution. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-93600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI...

Linux Distros Unpatched Vulnerability : CVE-2026-54355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for...

Security update for gh (important)

openSUSE Security Update: Security update for gh Announcement ID: openSUSE-SU-2026:0333-1 Rating: important References: 1278604 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVSS scores: CVE-2026-56854 SUSE: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N...

ROS-20260921-73-0063

The vulnerability in golang-x-crypto is related to errors in the certificate validation process. Exploitation of this vulnerability can be carried out remotely...

SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4045-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4045-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...

ALSA-2026:69293 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

RHEL 8 : rhc (RHSA-2026:69258)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:69258 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

OESA-2026-3940 rabbitmq-server security update

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fixes: RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improp...

Fedora 43 : opkssh (2026-38b019a0f0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-38b019a0f0 advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...

Fedora 45 : opkssh (2026-559bbb39f5)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-559bbb39f5 advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...