CVE-2026-84717 Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

EUVD-2026-85640

A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssmpro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The...

CVE-2026-96550 sfturing hosp_order MailUtil.java getProperties cleartext transmission

A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssmpro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The...

CVE-2026-96550

A vulnerability exists in sfturing hosp_order (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8 ) involving the getProperties function in ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. This flaw allows for the cleartext transmission of sensitive information via remote manipulation. A...

CVE-2026-96550 sfturing hosp_order MailUtil.java getProperties cleartext transmission

A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssmpro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The...

CVE-2026-96548

A flaw has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssmpro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity ...

CVE-2026-96549

A vulnerability has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssmpro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information...

CVE-2026-95604

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-93620

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

CVE-2026-84486

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user including unauthenticated clients and are routed in production builds because their URL include i...

DEBIAN-CVE-2026-75131

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

CVE-2026-96541

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global...

CVE-2026-63132

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

UBUNTU-CVE-2026-61814

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

kernel: mac802154: llsec: add skb_cow_data() before in-place crypto

A flaw was found in the Linux kernel's mac802154 IEEE 802.15.4 MAC security component. This vulnerability allows for data corruption and potential kernel crashes when cryptographic transformations are performed on shared network packet data without proper isolation. A remote attacker could exploi...

CVE-2026-94183 Address bar spoofing risk in affected Android versions of Arc Search

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

EUVD-2026-85570

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

CVE-2026-94183

Arc Search for Android versions prior to 1.12.10 are vulnerable to a UI spoofing risk. The application fails to display a fullscreen notification when a webpage enters fullscreen mode while the app is running in the background. A remote attacker can exploit this by using a specially crafted websi...

CVE-2026-96549 sfturing hosp_order CommonUserServiceImpl.java cleartext storage

A vulnerability has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssmpro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information...