CVE-2026-93642: Improper Neutralization of Input During Web Page Generation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-98102: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the filter was previously active, the code moved psf directly into...

PT-2026-98863

Name of the Vulnerable Software and Affected Versions Zimbra Classic affected versions not specified Description An unauthenticated sender can forge a share notification that triggers stored Cross-Site Scripting XSS, a vulnerability where malicious scripts are permanently stored on the target...

SUSE CVE-2026-97442

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...

CVE-2026-93290 Use of Hard-coded Credentials in Eufy Omni C20

Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data...

CVE-2026-86859

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

CVE-2026-86857

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

EUVD-2026-86400

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

CVE-2026-86857 Authorization Bypass in ServiceNow AI Platform

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...

DEBIAN-CVE-2026-97442

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...

EUVD-2026-86288

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 13 Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is...

CVE-2026-97442 wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...

CVE-2026-63132

A flaw was found in OpenBao, an open source identity-based secrets management system. A remote unauthenticated attacker could exploit a timing attack vulnerability in the handleLogicalRecovery path to infer a highly privileged recovery token. This token could then be used to authorize recovery mo...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift versions before 2.38.2 , a vulnerability exists because the tempurl middleware fails to reject the X-Copy-From header on PUT requests. Since the TempURL signature only validates the method, expiry, and path, an attacker with a valid PUT TempURL for a single object can include a...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

PT-2026-98247

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description An authorization bypass issue exists within the ServiceNow AI Platform. This flaw allows an authenticated user to access data they are not entitled to, which could potentially...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...