PT-2026-45007

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.480 Description A flaw in the netrw plugin allows arbitrary Vimscript execution when processing a crafted filename containing quote characters and expression fragments. This occurs during mark/unmark operations, where...

RHEL 9 : firefox (RHSA-2026:17688)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17688 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

PT-2026-54671

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.46 Description An inappropriate implementation in PDFium, a PDF rendering engine, allows a remote attacker to perform UI spoofing by using a specially crafted PDF file. Recommendations Update Google...

CVE-2026-43890

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscriptions/subscriptions.ts exhibits a broken authorization pattern. When both collectionId and documentId are supplied in the request, the route...

ECHO-21A6-33D6-5465 Tor Browser information exposure vulnerability. This CVE is for Tor Browser, not Firefox ESR. Tracked against firefox-esr only because Tor Browser is based on Firefox, but the vulnerability is in Tor-specific code not present in firefox-esr. https://security-tracker.debian.org/tracker/CVE-2019-12383

Bulletin has no description...

CVE-2026-41674

A flaw was found in xmldom and @xmldom/xmldom, a JavaScript library for parsing and serializing XML. This vulnerability allows an attacker to inject arbitrary XML markup into a document due to improper handling of DocumentType node fields during serialization. By crafting malicious input, an...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via insufficient access control in multiple API endpoints. An attacker can modify server-side configuration files, alter SQL index content, and manipulate recent document history by sending crafted requests to the...

MINI-P2XF-XW8J-MQ6W

Bulletin has no description...

MINI-6CP3-R6XR-PH2Q

Bulletin has no description...

MINI-P8JJ-8R52-4795

Bulletin has no description...

MINI-HJH9-PX7X-9RP6

Bulletin has no description...

MINI-72QC-CJ34-GCQW

Bulletin has no description...

CGA-2V28-9JF9-HRQC

Bulletin has no description...

Google Chrome PDF DoS

The vulnerability of the PDF component in the Google Chrome web browser relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure using a specially created PDF file...

Mattermost Uncontrolled Resource Consumption DoS

The vulnerability of the Mattermost instant messaging application is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted DOC file...

CVE-2026-42889

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889

Summary (CVE-2026-42889): Relay Server (used with Obsidian) versions 0.9.0–0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were treated as having full server permissions, all...

CVE-2026-42889

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...