FreeBSD : FreeBSD -- Multiple vulnerabilities in ppp(8) (204af099-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 204af099-a0ff-11f1-ae1f-bc241121aa0a advisory. ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator...

conduit -- authentication bypass vulnerability

Conduit team reports: Fixes a vulnerability where endpoints which required authentication, but functionality do not depend on the user/server calling it, could have their authentication bypassed, as well as causing crashes for all other authenticated endpoints. It is recommended you upgrade ASAP...

Linux Distros Unpatched Vulnerability : CVE-2026-79776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can...

CVE-2026-75601: Missing Authentication for Critical Function

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-46370: Improper Neutralization of Special Elements used in an SQL Command

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

PT-2026-82238

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

EUVD-2025-210785

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

PT-2026-82232

Name of the Vulnerable Software and Affected Versions Spring Spring Cloud Config versions 3.x through 3.1.14 Spring Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Spring Cloud Config versions 5.0.0 through 5.0.4 Description Missing...

PT-2026-82214

Name of the Vulnerable Software and Affected Versions ILIAS affected versions not specified Description An unauthenticated caller can trigger the deserialization of stored session data. The Shibboleth back-channel endpoint 'components/ILIAS/AuthShibboleth/resources/shib logout.php' operates in a...

PT-2026-82065

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

PT-2026-82360

Name of the Vulnerable Software and Affected Versions ddfourtwo sentry-selfhosted-mcp version 0.4.0 Description A flaw in the raw sentry api component allows for server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. This ...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2026-47837: Missing Authentication for Critical Function

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control vulnerability. A remote attacker can send a specially crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , leading to unauthorized modification of user data. To mitigate thi...

CVE-2026-75325

DWSurvey v6.14.0 is vulnerable to an authentication bypass flaw. The vulnerability can be triggered via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/ '** parameters. This flaw allows unauthorized access to restricted functionality. No specific remediation, exploit details, or in-the-wild explo...

CVE-2025-61164

A flaw in Cohere North AI v1.1.5 allows for an information leak through its WebSocket Endpoint . A remote attacker could exploit this vulnerability to gain unauthorized access to sensitive data. To mitigate this risk, users should disable the affected WebSocket endpoint in the service configurati...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...