CVE-2026-81846

CVE-2026-81846 is an authorization bypass in the runZero Platform MCP service , classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability allows a low-privilege network attacker to bypass authorization and access findings summaries data, resulting in a limited co...

USN-8690-1: Pillow vulnerability

It was discovered that Pillow did not properly manage memory when processing certain image files. An attacker could possibly use this issue to cause a denial of service or read sensitive data...

CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

CVE-2026-82580

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

WordPress SureFeedback Client Site plugin has a vulnerability related to information leakage

The WordPress SureFeedback Client Site plugin is a plugin that allows customers to leave visual feedback directly on their WordPress web pages. The WordPress SureFeedback Client Site plugin has a vulnerability related to information leakage, which stems from the exposure of sensitive data...

CVE-2026-82367

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

CVE-2026-81318

ash-project ash_sql (an Elixir SQL adapter for the Ash framework) contains an incorrect authorization flaw in AshSql.AggregateQuery.add_single_aggs/5. When computing an aggregate over a distinct query , the outer query is rebuilt from query.from.source alone, dropping the query.prefix / query.fro...

EEF-CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Summary Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the...

CVE-2026-80707

CVE-2026-80707 affects the Linux kernel's CAN J1939 transport subsystem. The function j1939_session_fresh_new() allocates a receive buffer without zeroing it, leaving residual data from prior allocations that could be exposed to a session participant. The root cause is an uninitialized memory dis...

CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

SUSE CVE-2026-64778

The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Visiting a maliciously crafted website may leak sensitive data...

SUSE CVE-2026-78894

Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-78962

Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-64778

A flaw was found in WebKitGTK. Visiting a malicious website may lead to a sensitive data leak due to improper validation checks. Mitigation Do not visit untrusted websites or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

SUSE CVE-2026-79272

Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

GHSA-X287-5C68-36WP OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

Linux Distros Unpatched Vulnerability : CVE-2026-78894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data...

Linux Distros Unpatched Vulnerability : CVE-2026-78962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin...

Linux Distros Unpatched Vulnerability : CVE-2026-78936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-install...

Linux Distros Unpatched Vulnerability : CVE-2026-64778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe...