CVE-2026-76907

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated call...

CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CVE-2026-94613

The authentik identity provider is vulnerable to a Denial of Service (DoS) attack via malformed SAML messages. An unauthenticated attacker can submit a message containing specific Document Type Declarations that cause the worker process handling /application/saml/* or /source/saml/* to stop. This...

CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CVE-2026-76907

The LaSuite Doc platform (versions 4.8.2 through 5.4.0) is vulnerable to public document enumeration via the GET /api/v1.0/documents/search/ endpoint. The root cause is that the API accepts sequential seven-digit document paths to scope searches without requiring the public document UUID. An unau...

CVE-2026-76907 LaSuite Doc: Public Documents Enumeration

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated call...

CVE-2026-76907 LaSuite Doc: Public Documents Enumeration

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated call...

CVE-2026-97155

The Fabasoft Folio Client (before 2026), including versions shipped with Fabasoft eGov-Suite , is vulnerable to unauthorized function invocation. The root cause is that the VALIDDOMAINS registry value, intended to restrict web origins, is optional and empty by default, causing the client to trust...

CVE-2026-97155

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empt...

CVE-2026-96749

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

Debian dsa-6512 : fonts-opensymbol - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6512 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6512-1 [email protected] https://www.debian.org/securit...

CVE-2026-76907: Exposure of Sensitive Information to an Unauthorized Actor

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated call...

CVE-2026-97155: Origin Validation Error

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empt...

CVE-2026-96749: Integer Overflow or Wraparound

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

PT-2026-97858

Name of the Vulnerable Software and Affected Versions BentoPDF versions prior to 2.8.7 Description The deserializeWorkflow function accepts the tsaUrl control of the Timestamp node from imported JSON without performing schema or destination validation. If a user imports a crafted workflow and...

Oracle E-Business Suite (September 2026 CSPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Personalization. Supported versions...

PT-2026-98233

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description An integer overflow exists in the BSON document encoding component of the bundled native extension. This occurs when a single document is constructed using an excessively large...

SUSE CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

CVE-2026-82409

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

CVE-2026-91865

A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessiv...