G DATA CyberDefense AG Motor.NET improper exception handling vulnerability

G DATA CyberDefense AG Motor.NET versions prior to 0.19.0 contain an improper exception handling vulnerability. This vulnerability allows attackers to send messages containing a specially crafted cloudEvents header to the consumption queue—such as invalid cloudEvents:motorversion, single...

Ricardo Olsen {json:scada} SQL injection vulnerability

Ricardo Olsen json:scada Versions prior to 0.65-alpha contain an SQL injection vulnerability. This vulnerability stems from improper handling of the HistoryReadRequest parameter NodeId.Id, StartTime, and EndTime within the opcApi function in src/serverrealtimeauth/index.js. Authenticated users ca...

Jitsu authorization issue vulnerability

Versions prior to jitsu 2.14.0-beta.41 contain an authorization issue vulnerability. This vulnerability arises because the sources/state.ts handler fails to use await when calling findFirst; as a result, ownership checks for sync IDs never fail. Consequently, authenticated users can read,...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in ChangeUserOrganizationView.post, allowing authenticated users to join any organization by providing a UUID. Once attackers obtain other organizations’ UUIDs, th...

MongoDB C# Driver input validation error vulnerability

Versions 2.0.0 through 3.13.0 of the MongoDB C Driver contain an input validation error vulnerability. This vulnerability stems from data validation flaws in BSON processing and binary serialization; it fails to verify whether the declared size in externally provided binary data matches the actua...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 has a security vulnerability stemming from a flaw in the PAPI protocol that allows authentication bypass. Unauthenticated attackers can circumvent authentication controls, potentially gaining administrator privileges, modifying system configurations, and accessing or tampering with...

Linux Distros Unpatched Vulnerability : CVE-2026-83381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142475)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142475 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40probe, inputregisterdevice was...

MongoDB C# Driver input validation error vulnerability

A vulnerability related to input validation exists in MongoDB C Driver versions 3.5.0 through 3.13.0. This vulnerability arises because the client-side encryption mode construction component fails to normalize and validate field identifiers provided by callers; these identifiers are then placed i...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143071)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143071 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsiscsicmdrsp copies the sense...

PT-2026-121296

Improper Handling of Highly Compressed Data Data Amplification in esaml binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml binding:decode response/2 base64-decodes the attacker-supplied...

Rocky Linux 10.2 [CIQ] Security Update: cockpit-machines Multiple Vulnerabilities (crlsa-2026_86971)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686971 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Dat...

Rocky Linux 9 [CIQ] Security Update: cockpit-machines Multiple Vulnerabilities (crlsa-2026_86970)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686970 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data...

Oracle MySQL Cluster 8.0.x < 8.0.50 (October 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Compiling OpenSSL. Supported versions that are affected...

Oracle MySQL Connectors NET (October 2026 CPU)

The versions of MySQL Connectors installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Net. The supported version that is affected is 26.7.0...

CVE-2026-103515

GitLab EE versions 19.2 before 19.3.6 , 19.4 before 19.4.3 , and 19.5 before 19.5.1 are vulnerable to an incorrect authorization issue (CWE-863). Due to insufficient granularity in admin-lock enforcement controls, an authenticated user with group Owner permissions could re-enable AI-backed data e...

CVE-2026-103515 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data...

CVE-2026-103515 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data...

CVE-2026-103515 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data...

CVE-2026-112326 Improper Cleanup on Thrown Exception in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to...