CVE-2026-1663

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in th...

CVE-2026-2463

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.. Mattermost Advisory ID:...

CVE-2026-26304

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2 fail to verify runcreate permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542...

CVE-2026-3611

The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest level 100 context, granting read/write...

CVE-2026-30953

LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL LinkRepository::create calls HtmlMeta::getFromUrl. The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-si...

CVE-2026-30970

Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Coral Server allowed the creation of agent sessions through the /api/v1/sessions endpoint without strong authentication. This endpoint perform...

CVE-2026-29079

Lexbor is a web browser engine library. Prior to 2.7.0, a type‑confusion vulnerability exists in Lexbor’s HTML fragment parser. When ns = UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting th...

CVE-2026-23489

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3...

CVE-2026-32254

Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds...

CVE-2026-33301

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An arbitrary file read...

CVE-2026-2992

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated...

CVE-2026-4312

GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account...

CVE-2026-2233

creationtimestamp| type| source ---|---|--- 2026-03-26 14:47:35+00:00| seen| https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mhxtvifkikt2...

CVE-2018-25213

creationtimestamp| type| source ---|---|--- 2026-03-26 14:45:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxtrin5432s 2026-03-28 04:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mi3qntwlre2a...

CVE-2026-27876

creationtimestamp| type| source ---|---|--- 2026-03-26 14:40:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhxtisjcsf26 2026-03-26 19:34:03+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/grafana-security-advisory-av26-285 2026-03-27 17:22:21+00:00| seen|...

CVE-2026-33412

creationtimestamp| type| source ---|---|--- 2026-03-26 14:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhxti7k5b32z 2026-04-20 12:52:14+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mjwj47pums2v...

CVE-2026-4809

creationtimestamp| type| source ---|---|--- 2026-03-26 14:03:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxrgxrhl225 2026-03-26 21:00:18+00:00| seen| https://infosec.exchange/users/offseq/statuses/116297486638382284 2026-03-26 21:00:19+00:00| seen|...

CVE-2018-25202

creationtimestamp| type| source ---|---|--- 2026-03-26 13:14:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxop4pjbf2z...

CVE-2026-4862

creationtimestamp| type| source ---|---|--- 2026-03-26 10:40:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxg3ige7z2d 2026-03-27 00:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhysskofyy2w...

SUSE-SU-2026:1063-1 Security update for frr

This update for frr fixes the following issues: Security issues: - CVE-2025-61099: NULL Pointer Dereference in FRRouting bsc1252838. - CVE-2025-61100: NULL Pointer Dereference in FRRouting bsc1252829. - CVE-2025-61101: NULL Pointer Dereference in FRRouting bsc1252833. - CVE-2025-61102: NULL Point...