CVE-2026-66786

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...

CVE-2026-55241 Checkmate: Pre-auth Denial of Service via File Upload on Registration

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...

CVE-2026-55241

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...

Exploit for CVE-2026-58455

CVE-2026-58455 — Dockwatch Unauthenticated RCE auth bypass +...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

BIT-MLFLOW-2026-69146 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFOREREQUESTHANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs...

CVE-2026-59799

Apache CloudStack is affected by an improper privilege management vulnerability in its Two-factor authentication plugin . The flaw allows for a bypass of the two-factor authentication disable flow due to a missing privilege check. This issue impacts versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0...

CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to...

PT-2026-80612

These are all security issues fixed in the perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-79483

Name of the Vulnerable Software and Affected Versions CrossWatch versions prior to 0.9.21 Description CrossWatch is a synchronization engine. An unauthenticated network attacker can access the 'GET /api/app-auth/status' endpoint without credentials. This endpoint returns the other sessions array,...

OPENSUSE-SU-2026:11564-1 perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 on GA media

These are all security issues fixed in the perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-55241: Uncontrolled Resource Consumption

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...

CVE-2026-53497: Exposure of Sensitive Information to an Unauthorized Actor

CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...

SUSE SLED15 / SLES15 Security Update : open-iscsi (SUSE-SU-2026:3647-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3647-1 advisory. - CVE-2026-44943: remote file-write as root via discovery bsc1268353. - CVE-2026-44944: iscsiuio control-socke...

AZL-96962 CVE-2026-53586 affecting package libgit2 for versions less than 1.7.2-3

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

CVE-2026-19586

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted...

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

CVE-2026-53586

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

GHSA-MRC5-3MM3-45C5 Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Summary Backpack\CRUD\Stats::makeCurlRequest builds a shell command using unescaped input that originates from the HTTP Host header, then passes it to exec. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user. T...

CVE-2026-53425 Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validateauthresp/3 in lib/samly/sphandler.ex validates a SAML response for the...