CVE-2026-94410

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected...

CVE-2026-94410

The Bender Custom&Partner Service is vulnerable to a Missing Authorization (CWE-862) flaw. A low-privileged remote attacker can access a list of roles that is intended to be restricted to administrators. This vulnerability results in a low-level confidentiality breach , although the documents sta...

PYSEC-2026-4050 foreman-mcp-server Inserts Sensitive Information into Log File

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug...

Astra Linux – Vulnerability in Linux, Linux 5.10

A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c within the Linux kernel. This flaw allows a local attacker with special user privileges CAPSYSADMIN or CAPSYSRAWIO to cause confidentiality issues...

Siebel Cloud Manager Data Compromise

The vulnerability of the Siebel Cloud Manager cloud version of the Siebel CRM Cloud Applications system’s customer relationship management system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

ROS-20260911-73-0040

The vulnerability of the Password component in Microsoft Edge and Google Chrome relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

Linux SPI Device Driver Use-After-Free

The vulnerability of the ep93xxspisetupdma function in the drivers/spi/spi-ep93xx.c file of the Linux operating system’s SPI device driver is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...

Google Chrome XML Component

The vulnerability of XML components in Google Chrome and Microsoft Edge relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a speciall...

Linux net/core/dev.c Buffer Overflow

The vulnerability in the net/core/dev.c module of the Linux operating system relates to accessing memory beyond the permissible buffer data size limits. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected...

Linux kernel Bluetooth L2CAP Buffer Overflow

The vulnerability of the l2capinformationrsp function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A division-by-zero error on some AMD processors may potentially return speculative data, resulting in a loss of confidentiality...

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

GHSA-6F2P-296R-CC28 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

PT-2026-80235

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

PT-2026-80744

Name of the Vulnerable Software and Affected Versions Tekton Pipelines-as-Code versions prior to 0.48.0 Description When configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by...

GHSA-JFJ5-WRJ9-63X4 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...

CVE-2026-71060

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financia...

CVE-2026-70988

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Content Acquisition System. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

CVE-2026-70836

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

CVE-2026-70785

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion component: Server. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...