CVE-2026-79778: Uncaught Exception

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

CVE-2026-77139: Improper Limitation of a Pathname to a Restricted Directory

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

CVE-2026-77144: Improperly Controlled Modification of Dynamically-Determined Object Attributes

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-79778: Uncaught Exception

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates...

PT-2026-81239

Name of the Vulnerable Software and Affected Versions Mask extension affected versions not specified Description An authenticated backend user with access to the Mask module can perform path traversal, a technique used to access files and directories that are restricted from the user. The extensi...

CVE-2026-79655: Improper Link Resolution Before File Access

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

PT-2026-82032

Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation in github.com/mattermost/mattermost-server...

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

PT-2026-81906

Kimai before 2.62.0 fails to validate create other timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view other timesheet and edit other timesheet permissions can create timesheet records for team members by submitting the QuickEntry form,...

CVE-2026-78677: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

The vulnerability of the mcp251x_open() function in the drivers/net/can/spi/mcp251x.c file of the Linux kernel’s CAN network device driver allows a hacker to cause a service failure.

The vulnerability of the mcp251xopen function in the drivers/net/can/spi/mcp251x.c file of the Linux kernel’s CAN network device driver is related to the creation of critical data packets. Exploiting this vulnerability could allow an attacker to cause a system failure...

Linux Distros Unpatched Vulnerability : CVE-2026-78677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone...

AZL-97649 CVE-2026-17113 affecting package cri-o 1.30.1-1

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling "mergeEnvs" in "server/utils.go", consumed by "setupContainerEnvironmentAndWorkdir" in "server/containercreate.go". When a "CreateContainer" request supplies a "nil" CRI "Envs" field, CRI-O falls back to using the target...

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

EUVD-2026-65080

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71504

Dolibarr versions prior to 24.0.0 contain an improper authorization flaw in the Members REST API . The API fails to verify password-change permissions, allowing an attacker who holds only member-creation rights to supply an arbitrary user identifier and new password in the request body, thereby r...

CVE-2026-71503

Dolibarr before 24.0.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the extra fields administration template . The type request parameter is reflected without JavaScript-context encoding into an inline [removed] block, and no Content-Security-Policy header is emitted. An...

CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...