ROS-20260716-73-0062

The vulnerability of the Downloads component in Microsoft Edge and Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260716-73-0070

The vulnerability of the Safe Browsing service in Microsoft Edge and Google Chrome is related to the use of memory after it is freed. Exploiting this vulnerability allows an attacker to compromise data integrity through the use of a malicious file...

The vulnerability of the Windows WLAN Host microprogramming system components in Qualcomm’s embedded chips allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Windows WLAN Host microprogramming software in embedded Qualcomm devices relates to reading beyond the buffer boundaries. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the Windows WLAN Host microprogramming system components in Qualcomm’s embedded chips allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Windows WLAN Host microprogramming software in embedded Qualcomm devices is related to writing beyond the buffer boundaries of memory. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected informatio...

Improper Authorization

n8n-mcp is vulnerable to Improper Authorization. The vulnerability is due to insufficient tenant isolation of locally stored workflow version history, which allows an authenticated tenant to read or delete workflow backups belonging to other tenants, exposing sensitive configuration data and...

CVE-2026-59733

A flaw was found in Rclone. When using the rclone serve restic --private-repos command, an authenticated user can include directory traversal sequences e.g., .. in a request. This allows them to bypass authorization and read, overwrite, or delete another user's private repository on backends that...

undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing

A flaw was found in undici. When using Socks5ProxyAgent, undici incorrectly reuses a single connection pool across different origins. This can lead to cross-origin request routing, where sensitive credentials and data intended for one destination are sent to another. Consequently, responses from...

Security update for python-paramiko

This update for python-paramiko fixes the following issues: CVE-2026-44405: data integrity compromise due to allowed SHA-1 algorithm use bsc1264225. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

SUSE-SU-2026:3031-1 Security update for python-paramiko

This update for python-paramiko fixes the following issues: - CVE-2026-44405: data integrity compromise due to allowed SHA-1 algorithm use bsc1264225...

SUSE CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

The vulnerabilities of the modheaders and mod_mime modules in the Apache HTTP Server allow attackers to compromise the confidentiality and integrity of protected information.

The vulnerability of the modheaders and modmime modules in the Apache HTTP Server relates to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

The vulnerability in the `vault/namespace_store.go` file of the OpenBao system for managing secrets and encryption allows a perpetrator to compromise the integrity of the protected information.

The vulnerability in the vault/namespacestore.go file of the OpenBao encryption and secret management system is related to improper inter-bordering of critical data. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

The vulnerability of the base64.b64decode() function in the Python programming language interpreter (CPython) allows a attacker to compromise the integrity of protected information.

The vulnerability of the base64.b64decode function in the Python programming language interpreter CPython is related to insufficient validation of data authenticity. Exploiting this vulnerability could allow an attacker to compromise the integrity of protected information...

Vulnerability of the Audio/Video component: The playback feature in browsers Firefox and Firefox ESR, as well as in the email client Thunderbird, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Audio/Video component: The playback functions of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are vulnerable due to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to compromise the...

CVE-2026-14685

A flaw was found in HdrHistogram. A local attacker could exploit this vulnerability by manipulating the 'Count' argument within the recordValueWithCount function. This manipulation leads to a state issue, which could impact the integrity of data processing within the affected component. Mitigatio...

CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-44761

SAP Commerce Cloud is affected by CVE-2026-44761, where a sample OAuth2 client may retain publicly documented sample credentials from SAP Help Portal configuration. If left unchanged, an unauthenticated attacker could obtain a valid access token and invoke certain APIs to read and modify data, re...

CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

Frigte has broken access control viewer user can delete admin and other users account

SummaryUsers with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity. DetailsEndpoint DELETE /api/users/admin is enable to anonymous user. PoCI deleted admin user on demo.frigate.video: ImpactIt this leads to denial of service a...

PYSEC-2026-2483 Frigte has broken access control viewer user can delete admin and other users account

Summary Users with the viewer role can delete admin and other users account. It this leads to denial of service and affects data integrity. Details Endpoint DELETE /api/users/admin is enable to anonymous user. PoC I deleted admin user on demo.frigate.video: Impact It this leads to denial of servi...