Astra Linux – Vulnerability in Perl

HTTP::Tiny, a Perl core module since version 5.13.9 and available as a standalone package on CPAN, has an insecure default TLS configuration. In this configuration, users are required to explicitly choose to verify certificates...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfsd: Clearing aclaccess/acldefault after releasing them If the attempt to get acldefault fails, both aclaccess and acldefault will be released simultaneously. However, aclaccess will still retain a pointer pointing to the releas...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Use RCU protection in ip6defaultadvmss. ip6defaultadvmss requires RCU protection to ensure that the network structure it reads does not disappear...

CVE-2026-100103 Authentication bypass via default auth token in P4Search

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

CVE-2026-100103 Authentication bypass via default auth token in P4Search

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

CVE-2026-88391

Northstar (dromara/northstar, quantitative trading platform) versions

EUVD-2026-92443

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

PT-2026-105996

Name of the Vulnerable Software and Affected Versions Northstar versions prior to 9.1.2 Description The software enables the H2 Console, but the authentication interceptor only covers the /northstar/ endpoint, leaving the /h2-console endpoint exposed without authentication. Additionally, the...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

CVE-2026-100103: Use of Default Credentials

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

CVE-2026-86817 Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...

CVE-2026-86817

The Five Star Business Profile and Schema WordPress plugin (versions 2.3.20-2.3.21 ) is vulnerable to a sensitive data disclosure flaw. The issue stems from the plugin failing to properly restrict callbacks used to resolve schema field default values. This allows authenticated users with Author-l...

PT-2026-104623

Name of the Vulnerable Software and Affected Versions SciPhi-AI R2R versions prior to 3.6.7 Description The JWT Secret Handler component contains hard-coded credentials. This issue occurs due to the manipulation of the DEFAULT BCRYPT SECRET KEY and DEFAULT NACL SECRET KEY arguments, which allows ...

Linux Distros Unpatched Vulnerability : CVE-2026-85494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value,...

Linux Distros Unpatched Vulnerability : CVE-2026-85086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache...

NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...

GHSA-PQXW-G93W-HJ9X Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from hosting/docker/.env.example are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise. Vulnerability Details The...

NPM: Trigger.dev: V1 coordinator default-secret unauth Socket.IO

NPM: Trigger.dev: V1 coordinator default-secret unauth Socket.IO vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.4...

SUSE CVE-2026-94634

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105383 CVE-2026-85086 affecting package thrift 0.24.0-1

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...