SUSE CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

EUVD-2026-66815

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

EUVD-2026-66804

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

EUVD-2026-66803

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

EUVD-2026-66760

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account...

EUVD-2026-66763

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

EUVD-2026-66764

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

SUSE CVE-2026-65182

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

SUSE CVE-2026-65183

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 throug...

SUSE CVE-2026-68525

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

SUSE CVE-2026-72495

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to...

SUSE CVE-2026-79017

Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Low...

PT-2026-82778

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

PT-2026-82789

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

CVE-2026-37072

Veno File Manager Project 4.4.9 is vulnerable to an Incorrect Access Control flaw in admin-head-updates.php, specifically a Local File Inclusion via the lang GET parameter. An unauthenticated attacker can send a specially crafted POST request to corrupt the configuration file, then hit the setup ...

PT-2026-82450

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.11.0 through 3.17.0 Description An LDAP Injection occurs due to improper neutralization of special elements used in an LDAP query. This allows a caller with valid credentials for one LDAP directory entry to authenticat...

PT-2026-82730

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description An unauthenticated user can execute arbitrary SQL statements against the underlying database of the ServiceNow AI platform. This occurs via a SQL injection in the dynamic schem...

SUSE SLES15 Security Update : kernel (Live Patch 7 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3768-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3768-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.25 fixes various security issues: The following security issues were fixed: -...