PT-2026-72067

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112 Description The canonicalizeParams function in src/utils/cache.ts serializes request parameters using unescaped ampersand, equals-sign, and vertical-bar delimiters. This flaw allows different logical...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...

CVE-2026-72643

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CVE-2026-72643 Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

EUVD-2026-58288

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CVE-2026-72643

CVE-2026-72643 describes an Incorrect Authorization in Kibana Agent Builder where a caller’s ownership check uses a stable user identifier or falls back to username, which is not unique across Elasticsearch realms. This allows disclosing the configuration/instructions of an agent the caller does ...

CVE-2026-72643

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

SUSE CVE-2026-68093

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes through a hotplug cycle online-offline-online, and the vCPU then resume...

CVE-2026-68093

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine. When a virtual CPU vCPU is scheduled out and its physical CPU pCPU undergoes a hotplug cycle offline and then online, the vCPU might resume with an Address Space Identifier ASID that has been reassigned to another vCPU from ...

CVE-2026-73219 CVAT: Denial of service with regards to automatic annotation

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

CVE-2026-10050

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

CVE-2026-72537 Authentik Security authentik - Privilege Escalation

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user inges...

UBUNTU-CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68093

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes through a hotplug cycle online-offline-online, and the vCPU then resume...

CVE-2026-68093

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes through a hotplug cycle online-offline-online, and the vCPU then resume...

EUVD-2026-55275

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68093 KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes through a hotplug cycle online-offline-online, and the vCPU then resume...

...[ More ]

A proof of concept exploit for an authorization bypass vulnerability in Traefik version 3.7.9. The vulnerability affects the Kubernetes Gateway API provider and results from ambiguous dynamic configuration object identifiers constructed by joining namespace and object names with hyphens. Differen...

Linux Distros Unpatched Vulnerability : CVE-2026-68093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes...