NewStart CGSL MAIN 7.02 : bind Multiple Vulnerabilities (NS-SA-2026-0110)

The remote NewStart CGSL host, running version MAIN 7.02, has bind packages installed that are affected by multiple vulnerabilities: - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions...

Debian dsa-6490 : fort-validator - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6490 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6490-1 [email protected] https://www.debian.org/security/ Moritz...

PT-2026-87119

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation...

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-3270)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : dlm: validate length in dlmsearchrsbtreeCVE-2026-43125 net: annotate data-races around sk-skdataready,writespaceCVE-2026-23302 netfilter: ctnetlin...

CVE-2026-82755

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

EEF-CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Summary Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-82755

ash_authentication_oauth2_server (ash-project, versions 0.1.3 through before 0.3.1) suffers from a cache-poisoning issue in its RFC 8414 / RFC 9728 metadata endpoints (AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter). When a tenant is derived from a header or Host value rather than the URL,...

CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

EUVD-2026-72537

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in a shared token cache that permits cross-tenant theft of GitHub App installation tokens . An attacker with low privileges over the network (no user interaction required) can steal tokens belonging to other tenants, ...

EUVD-2026-72508

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

USN-8728-1 linux-gcp-7.0 vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

USN-8728-1: Linux kernel (GCP) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

Unbounded Cache Size

Spring Cloud Stream is vulnerable to an unbounded cache size. The vulnerability is due to improper bounding of the dynamic destination cache size, where the cache can grow without limit and attackers can trigger excessive memory usage to cause a denial‑of‑service condition...

Security Bulletin: IBM ApplinX is vulnerable to an Improper Neutralization of Input during web generation and Insufficient verification of data authenticity vulnerabilities due to use of Angular compiler and common-joins (CVE-2026-69151, CVE-2026-68945)

Summary IBM ApplinX is vulnerable to an Improper Neutralization of Input during web generation and Insufficient verification of data authenticity vulnerabilities due to use of Angular compiler and comma-joins CVE-2026-69151, CVE-2026-68945 The affected versions have been updated within IBM Applin...