ROS-20261023-73-0020

The vulnerability in sudo is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20261023-73-0231

The vulnerability in Grafana relates to bypassing the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20261023-73-0032

The vulnerability in Jenkins is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20261023-73-0157

The vulnerability in Jenkins is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20261023-73-0002

The vulnerability of TLS and SSL OpenSSL tools is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ROS-20261023-73-0018

The vulnerability in golang-github-prometheus is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Node.js Node permissions and access control issues vulnerability

Node.js versions 22.23.3 and earlier, 24.22.0 and earlier, and 26.12.0 and earlier contain a permission and access control vulnerability. This vulnerability stems from incomplete enforcement of the Permission Model file system; fs.realpathSync lacks necessary read permission checks. As a result,...

ROS-20261023-73-0024

The vulnerability in Jenkins is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20261023-73-0151

The vulnerability in Jenkins is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20261023-73-0128

The vulnerability in libheif is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20261023-73-0001

The vulnerability of TLS and SSL OpenSSL tools is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792751700)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792751700 advisory. - In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tpip6sendmsg When len =...

SUSE CVE-2026-98566

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

SUSE CVE-2026-98583

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-92450

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can...

CVE-2026-110491

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be...

Incomplete List of Disallowed Inputs

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via JWTBearerGrant.verifyclaims in authlib/oauth2/rfc7523/jwtbearer.py, where audience validation is skipped when getaudiences retur...

DEBIAN-CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...