CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...

DEBIAN-CVE-2026-97442

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...

EUVD-2026-86288

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 13 Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is...

CVE-2026-97442 wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...

CVE-2026-63132

A flaw was found in OpenBao, an open source identity-based secrets management system. A remote unauthenticated attacker could exploit a timing attack vulnerability in the handleLogicalRecovery path to infer a highly privileged recovery token. This token could then be used to authorize recovery mo...

Astra Linux – Vulnerability in Chromium

Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data through a crafted Chrome extension. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

In ANGLE, an uninitialized resource in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to obtain cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Missing authorization in the FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Botslab G980H Dashcams

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation. 2. RECOMMENDED PRACTICES CISA...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift versions before 2.38.2 , a vulnerability exists because the tempurl middleware fails to reject the X-Copy-From header on PUT requests. Since the TempURL signature only validates the method, expiry, and path, an attacker with a valid PUT TempURL for a single object can include a...

PT-2026-98255

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description An authorization bypass issue exists in the ServiceNow AI Platform. This flaw allows an unauthenticated user to access data they are not entitled to, which could potentially le...

PT-2026-98247

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description An authorization bypass issue exists within the ServiceNow AI Platform. This flaw allows an authenticated user to access data they are not entitled to, which could potentially...

CVE-2026-86859: Improper Access Control

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

ROS-20260924-73-0075

The vulnerability of the mcbausb component in the Linux operating system’s kernel is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

ROS-20260924-73-0066

The vulnerability of the i40e component in the Linux operating system is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97442

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...