EUVD-2026-91048

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint...

DEBIAN-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

UBUNTU-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056 CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

The Authlib library (version 1.7.2 and below) contains a vulnerability where OpenID Connect (OIDC) and OAuth discovery metadata is cached without sufficient validation or issuer-origin binding . A remote attacker providing a malicious discovery response can replace legitimate service endpoints wi...

CVE-2026-67171

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

CVE-2026-13043

A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...

PYSEC-2026-4081 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

SummaryAny authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

SummaryAny member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...

PYSEC-2026-4122 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...

django-canary-endpoint (0.1.2), django-debug-toolbar (>=0.10.0, <=0.10.2) potentially affected by CVE-2026-15307 via django (1.5.12)

django PYPI version 1.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-canary-endpoint 0.1.2 - django-debug-toolbar =0.10.0, =0.10.2 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

EUVD-2026-57810

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block...

CVE-2026-67171 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

EUVD-2026-90903

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

CVE-2026-67171 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

CVE-2026-67171

HCL BigFix Service Management is impacted by an Information Disclosure vulnerability. The root cause is an exposed API endpoint that reveals sensitive internal database information, which could be leveraged by an attacker to facilitate targeted database attacks . No specific exploit details or re...

CVE-2026-13043 WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access

A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...

CVE-2026-13043

WatchGuard endpoint security products are affected by a missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) . A local, authenticated attacker can bypass the driver's access-control handshake to issue arbitrary privileged commands. This flaw allows for the disclosure o...