CVE-2026-77538

An Improper Access Control vulnerability in the UniFi Connect Application (Ubiquiti) allows a network-based attacker with no prior privileges to escalate privileges within the application. The CVSS 3.1 score is 8.2 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, indicating a low-comp...

CVE-2025-61479

Vanderbilt Industries Acre Security SPC5300.000 Main Board version 3.14.1 is affected by a denial-of-service vulnerability. The root cause is that SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session, allowing a physically proximate attacker to ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098945)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098945 advisory. In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect if already established During connect, acting on a...

EUVD-2025-210803

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session...

Linux Distros Unpatched Vulnerability : CVE-2026-70665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098895)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098895 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg/sendto with MSGFASTOPEN i...

DEBIAN-CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

UBUNTU-CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect (a Rails OpenID Connect provider built on Doorkeeper) is vulnerable to scope privilege escalation prior to version 1.10.4 . The Dynamic Client Registration (DCR) endpoint (DynamicClientRegistrationController#application_params) assigns the scope parameter directly from p...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

EUVD-2026-36714

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching...

PT-2026-81890

Name of the Vulnerable Software and Affected Versions Doorkeeper OpenID Connect versions prior to 1.10.4 Description The Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. In the...

CVE-2026-58210

A flaw was found in NATS Server. An unauthenticated remote attacker could send large, incomplete MQTT CONNECT packets to the server. This action causes the server to retain these packets, consuming significant memory before authentication is complete. This can lead to a denial of service DoS...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected MariaDB installations. Authentication is required to exploit this vulnerability. The specific flaw exists within the processin...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed issues related to locking and validity checks for isoconn. sk-skstate indicates whether isopisk-conn is valid. Operations that check or update skstate and access conn should hold locksock; otherwise, they...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fixed the duplicated IWCMEVENTCONNECTREPLY event reported. If siwrecvmparr returns -EAGAIN, it means that the MPA reply has not been fully received, and IWCMEVENTCONNECTREPLY should not be reported in this case. This ma...