CVE-2026-104183

A flaw was found in stream-json. When parsing JSON data, the Assembler component directly assigns properties, allowing an input key named 'proto' to replace a parsed object's internal prototype rather than creating a standard property. An attacker who supplies crafted input can exploit this...

CVE-2026-47492

A flaw was found in the NVIDIA GPU Display Driver. Due to improper access control in the kernel mode layer, an authenticated local attacker can exploit this vulnerability to cause a Denial of Service DoS, resulting in system instability or driver disruption...

PT-2026-105160

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is authorized/2 for the /federation-links/.../restart route uses is authorized monitor accepts the monitoring tag, while allowed methods permits DELETE and delete resource/2 triggers rabbit...

AlmaLinux 9.2 [TuxCare] Security Update: mod_dav_svn / python3-subversion / subversion / subversion-devel / etc (ALMALINUX9.2:CLSA-2025:1754941300)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754941300 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated...

CentOS Linux 6 [TuxCare] Security Update: mod_dav_svn / subversion / subversion-devel / subversion-gnome / etc (CENTOS6:CLSA-2025:1755074254)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1755074254 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated use...

PT-2026-103286

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause generation, /abort request, /flush cache, and /init weights update group to disrupt inference operations and wedge...

PT-2026-103558

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description The sandbox used to isolate document conversion on a Kiteworks appliance fails to fully confine the code executing within it. This allows code already running inside the sandbox to escape i...

CentOS Linux 8.5 [TuxCare] Security Update: mod_dav_svn / subversion / subversion-devel / subversion-gnome / etc (CENTOS8.5:CLSA-2025:1756409018)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1756409018 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1768395381)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1768395381 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the...

CentOS Linux 8 [TuxCare] Security Update: mod_dav_svn / subversion / subversion-devel / subversion-gnome / etc (CENTOS-STREAM8:CLSA-2025:1756489732)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1756489732 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows...

Rocky Linux 9.6 [TuxCare] Security Update: mod_dav_svn / python3-subversion / subversion / subversion-devel / etc (ALMALINUX9.6:CLSA-2026:1778495013)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778495013 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticat...

CentOS Linux 8.4 [TuxCare] Security Update: mod_dav_svn / subversion / subversion-devel / subversion-gnome / etc (CENTOS8.4:CLSA-2025:1756408610)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1756408610 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated...

EUVD-2026-88669

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...

PT-2026-102475

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation...

CVE-2026-84657

A flaw was found in Jenkins. The build command-line interface CLI does not properly enforce permissions when canceling a build. An attacker with Item/Build permission can exploit this by using the -s flag to cancel builds initiated by other users, leading to unauthorized disruption of ongoing...

CVE-2026-100891

A flaw was found in OpenDMARC. An encoding error in the Internationalized Domain Name IDN handler within the opendmarcpolicyquerydmarc function can cause domain name queries to fail or process incorrectly. A remote attacker could exploit this vulnerability by submitting specially crafted domain...

CVE-2026-100854

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

EUVD-2026-87834

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

CVE-2026-47834

A flaw was found in Spring Data JPA. This vulnerability allows a remote attacker to bypass data validation mechanisms by submitting specially crafted input. This could lead to unauthorized access to limited information and minor disruptions in service availability. Mitigation There is no mitigati...

CVE-2026-44642 Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...