CVE-2026-8063

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads...

CVE-2026-35672

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via PO...

MINI-W58W-Q834-MRPX

Bulletin has no description...

MINI-V5PC-JG5X-957W

Bulletin has no description...

MINI-G235-8RCF-R7H9

Bulletin has no description...

MINI-94V9-HCF7-87HM

Bulletin has no description...

MINI-66RX-2773-9GF2

Bulletin has no description...

gnutls security update

An update is available for gnutls. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gnutls packages provide the GNU Transport Layer Security GnuTLS library,...

MINI-RHGG-W9V2-2R2V

Bulletin has no description...

MINI-2MC2-HQ6X-CWRC

Bulletin has no description...

MINI-WXG6-922P-8VQQ

Bulletin has no description...

BIT-AUTHENTIK-2026-49448 authentik: SourceStage bypass via empty POST

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1...

MINI-5XCR-5479-36X7

Bulletin has no description...

MINI-5GQJ-JQMX-255Q

Bulletin has no description...

MINI-HM82-RC69-2CXR

Bulletin has no description...

MINI-J5FR-W6PV-QWF2

Bulletin has no description...

MINI-PMGP-GC98-5V2R

Bulletin has no description...

MINI-6V4Q-M4CX-H7QJ

Bulletin has no description...

MINI-M98W-H2JQ-6F8F

Bulletin has no description...

CVE-2026-41207 netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDFexpand returns non-NULL on failure. The byte is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a...