CVE-2026-68930

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, serverreadauthenticated, and the execrequest callback. Version 0.62.5 fixes the issue...

CVE-2026-68930 Russh: Channel-scoped server callbacks can be reached without an open channel

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, serverreadauthenticated, and the execrequest callback. Version 0.62.5 fixes the issue...

CVE-2026-68930 Russh: Channel-scoped server callbacks can be reached without an open channel

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, serverreadauthenticated, and the execrequest callback. Version 0.62.5 fixes the issue...

CVE-2026-48113: Incorrect Authorization

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...

PT-2026-67442

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server read authenticated, and the exec request callback. Version 0.62.5 fixes the issue...

The vulnerability of Google Chrome’s Navigation function allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s Navigation function is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

GHSA-P849-8HWH-84J9 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any...

SUSE CVE-2025-11776

Mattermost versions 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the /api/v4/teams/teamid/channels/searcharchived endpoint...

SUSE CVE-2025-41436

Mattermost versions 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads...

SUSE CVE-2026-5163

Mattermost versions 11.5.x = 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite...

The vulnerability of the FrodoEngine.Java file in the Bouncy Castle cryptographic library for the Java platform allows a hacker to disclose protected information.

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library relates to the use of hidden time channels for data transmission. Exploiting this vulnerability allows a remote attacker to disclose the protected information...

SUSE CVE-2026-28759

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel,...

SUSE CVE-2026-62432

The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...

CNVD-2022-60632

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:00+00:00| seen| https://t.me/CVEhub/2472 2026-07-29 12:01:01+00:00| seen| https://t.me/CVEhub/2204 2026-07-30 00:01:39+00:00| seen| https://t.me/CVEhub/2472 2026-07-30 00:01:40+00:00| seen| https://t.me/CVEhub/2204 2026-08-01...

SUSE SLES12 Security Update : libssh (SUSE-SU-2026:3302-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3302-1 advisory. This update for libssh fixes the following issues - CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler...

ALPINE-CVE-2026-62432

The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...

CVE-2026-62432

The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...

CVE-2026-62432

The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...

CVE-2026-62432

The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...

CVE-2026-62432 evtchn: Race between FIFO expand and reset

The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...