CVE-2026-77152: Drupal Field Collection for Drupal 7: Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field…

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent host entity. The access check for field collection items fieldcollectionitemaccess granted edit and delete access to any...

Incorrect Authorization

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

Incorrect Authorization

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

USN-8952-1: Tornado vulnerabilities

It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,...

proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...

Astra Linux – Vulnerability in Chromium

Missing authorization in the FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a co-installed app. Chromium security severity: High...

io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

CVE-2026-92395

A flaw was found in @fastify/proxy-addr. This flaw allows a remote, unauthenticated attacker to bypass access controls and security policies by spoofing client IP Internet Protocol addresses. When configured with certain IPv4-mapped IPv6 network ranges, the plugin improperly treats all incoming...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities (CVE-2026-93895, CVE-2026-95695, CVE-2026-95696)

Summary IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities with grpc-1.0 enabled. Vulnerability Details CVEID:CVE-2026-93895 DESCRIPTION: WebSphere Application Server Liberty could allow an unauthenticated remote attacker to bypass access controls configured on gRPC...

VulnCheck KEV: CVE-2025-7721

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the...

PT-2026-121734

Several vulnerabilities were discovered in rsync, a fast, versatile, remote and local file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code...

CVE-2026-90711

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-106404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass syste...

Linux Distros Unpatched Vulnerability : CVE-2026-106285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access...

Linux Distros Unpatched Vulnerability : CVE-2026-106326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page...

Linux Distros Unpatched Vulnerability : CVE-2026-106427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged pag...

Linux Distros Unpatched Vulnerability : CVE-2026-106307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system...

Linux Distros Unpatched Vulnerability : CVE-2026-106385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access...

SUSE CVE-2026-106188

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...