SUSE CVE-2026-57521

Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers...

CVE-2026-28701

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths...

CVE-2026-28701

CVE-2026-28701 affects various versions of Daktronics Controller Firmware. The vulnerability is a path traversal flaw permitting authenticated or unauthenticated remote users to escape the intended directory and enumerate arbitrary filesystem paths, with potential high impact to confidentiality, ...

CVE-2026-28701 Daktronics Controller Firmware Path Traversal

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: cilium, cert-manager, kyverno, falco-no-driver, calico-fips, prometheus-elasticsearch-exporter, flux-image-automation-controller, prometheus-mongodb-exporter, trivy-fips, k3s, opentofu, tekton-pipelines, zitadel, nemo, gitea-fips, prometheus-operator, skaffold, aactl...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs, falcoctl-fips, cert-manager, src, crossplane-provider-aws-efs, kyverno, crossplane-provider-aws-iam, prometheus-elasticsearch-exporter, terraform-provider-aws-fips, crossplane-provider-family-aws-fips, gomplate-fips, nemo,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: cilium, gatus-fips, cert-manager, apko-fips, kyverno, falco-no-driver, calico-fips, prometheus-elasticsearch-exporter, splunk-otel-collector-fips, guac, amazon-ssm-agent-fips, flux-image-automation-controller, gptscript, prometheus-mongodb-exporter, trivy-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cilium, falcoctl-fips, gatus-fips, cert-manager, apko-fips, caddy-fips, kyverno, ko, falco-no-driver, calico-fips, fulcio, prometheus-elasticsearch-exporter, splunk-otel-collector-fips, flux-kustomize-controller-fips, tekton-chains-fips, guac, amazon-ssm-agent-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: cilium, cert-manager, kyverno, falco-no-driver, calico-fips, prometheus-elasticsearch-exporter, flux-image-automation-controller, prometheus-mongodb-exporter, trivy-fips, k3s, opentofu, tekton-pipelines, zitadel, nemo, gitea-fips, prometheus-operator, skaffold, aactl...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: cilium, cert-manager, apko-fips, kyverno, falco-no-driver, calico-fips, prometheus-elasticsearch-exporter, splunk-otel-collector-fips, guac, amazon-ssm-agent-fips, flux-image-automation-controller, gptscript, prometheus-mongodb-exporter, trivy-fips, k3s, opentofu,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, telegraf, flux-image-automation-controller, pulumi-language-yaml, ksops, kubernetes, openbao, argo-cd, crossplane-provider-azure-sql, k3s, wal-g, crossplane-provider-aws-dynamodb, docker-compose, falcoctl, kyverno,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, telegraf, flux-image-automation-controller, pulumi-language-yaml, ksops, kubernetes, docker-machine-driver-harvester, openbao, argo-cd, crossplane-provider-azure-sql, k3s, wal-g, falcoctl, kyverno, flux-notification-controller,...

DEBIAN-CVE-2026-53295

In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers...

CVE-2026-53295

In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers...

EUVD-2026-39835

In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potential DMA use-after-free issue 1. If netcxmitntmpcmd times out and returns an error, the pending command is not explicitly aborted, while...

EUVD-2026-39900

In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers...

CVE-2026-53295

In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers...

CVE-2026-53295 mailbox: add sanity check for channel array

In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if there is no channel array attached to the mailbox controller. Otherwise the later dereference will cause an OOPS which might not be seen because mailbox controllers...

CVE-2026-52781

OpenProject CVE-2026-52781 affects the open-source, web-based project management software. Prior to versions 17.3.3 and 17.4.1, the HTML sanitizer allowed elements to have unrestricted data-* attributes via a :data wildcard. An attacker could inject data-controller="poll-for-changes" into a work...

CVE-2026-52781 OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount ...