EUVD-2026-60391

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

CVE-2026-75479

JimuReport's report folder template listing endpoint lacks authentication, letting unauthenticated attackers enumerate all reports, harvest share tokens, then access protected endpoints to retrieve full report definitions including embedded SQL and live query data. CVSS 3.1 scores this HIGH (7.5)...

CVE-2026-75479 JimuReport Unauthenticated Report Listing and Share Token Disclosure

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

CVE-2026-75479 JimuReport Unauthenticated Report Listing and Share Token Disclosure

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

CVE-2026-75110 MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...

CVE-2026-75110

CVE-2026-75110 is a critical authentication bypass in MemOS , a memory operating system for LLMs and AI agents. When AUTH_ENABLED=true but the undocumented INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open due to ...

CVE-2026-75110 MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...

CVE-2026-75108 Next Terminal Missing Per-Asset Authorization on Portal Endpoints

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...

GHSA-FM65-XRRR-C358 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

CVE-2026-69185 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

MINI-PHCQ-V7R9-2XGM

Bulletin has no description...

MINI-8842-3657-32Q9

Bulletin has no description...

CVE-2026-19650 Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

ANT-2026-B324R0JY · syncthing/syncthing · auth_bypass

auth-bypass high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-B324R0JY: stdiscosrv trusts proxy header for client identity...

MINI-89V4-GJ6V-PGX2

Bulletin has no description...

MINI-G68X-624M-PJV3

Bulletin has no description...

UBUNTU-CVE-2026-62982

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

RLSA-2026:55432 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Information disclosure due to uncleared proxy authentication state CVE-2026-8927 For more details about the security...

curl security update

An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...