EUVD-2026-78170

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynami...

CVE-2026-79303

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-79303

The kaiten project management tool (versions 57.192.20 to before 57.214.26 ) is vulnerable to a Boolean-blind SQL Injection (CWE-89). The root cause is the Hibernate query service implementation, which generates dynamic SQL statements without proper data validation, parameterized statements, or s...

EUVD-2026-78816

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-79303: Improper Neutralization of Special Elements used in an SQL Command

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

PT-2026-93171

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...

CVE-2026-91782: NULL Pointer Dereference

A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elfx86allocatedynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The attack requires a local approach. The...

PT-2026-91903

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.47 Description A null pointer dereference occurs in the Dynamic Relocation Allocation component within the elf x86 allocate dynrelocs function of the bfd/elfxx-x86.c file. This issue can be triggered via a local approach...

CVE-2026-79303

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-73449

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynami...

CVE-2026-73449

Arista EOS is vulnerable when both 802.1X port authentication and RADIUS proxy are configured with dynamic authorization. A low-privileged attacker on an adjacent network segment can induce a RADIUS packet through a configured RADIUS proxy client, preventing Change-of-Authorization (CoA) and Disc...

CVE-2026-73449 On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynami...

CVE-2026-55451

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-12985

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

CVE-2026-12985

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscpi: Fixed string overflow in the SCPI genpd driver. Without the bounds checks for scpipd-name, a buffer overflow could occur when copying the SCPI device name from the corresponding device tree node. This occurs...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: regulator: max20086: fix invalid memory access The issue arises from calls to ofregulatormatch, where an array of struct ofregulatormatch is used as the argument for the matches parameter. This array is allocated on the stack. As...

Astra Linux – Vulnerability in isc-dhcp

In ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16, ISC DHCP 4.4.0 - 4.4.2 Other branches of ISC DHCP e.g., releases in the 4.0.x series or earlier, and releases in the 4.3.x series are beyond their End-of-Life period and are no longer supported by ISC. It is clear that this defect is also present in releases...

Astra Linux – Vulnerability in freerdp3

FreeRDP before version 3.22.0 contains a use-after-free vulnerability in the dvcmanchannelclose and dvcmancallonreceive functions, due to improper synchronization of channel callback access. A malicious RDP server can trigger a race condition by sending DYNVCDATA and DYNVCCLOSE messages...