Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content,...

CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

CVE-2026-53302

In the Linux kernel, the following vulnerability has been resolved: crypto: eip93 - fix hmac setkey algo selection eip93hmacsetkey allocates a temporary ahash transform for computing HMAC ipad/opad key material. The allocation uses the driver-specific cradrivername e.g. "sha256-eip93" but passes...

Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs

Woodgnat Hackers use Backdoor.Mistic, a stealthy RAT, to let brokers compromise networks and sell entry points to ransomware groups, putting firms at risk...

CVE-2026-53053

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit AMD driver. The clonealias function incorrectly uses the device ID devid when handling alias devices. This can lead to the propagation of wrong or stale Device Table Entry DTE entries to alias devices, potentially...

CVE-2026-53108

A flaw was found in the Linux kernel. A race condition exists between the movepages system call, which sets up a Page Middle Directory PMD migration entry, and the munmap system call, which unmaps memory regions. This race can be exploited by a local user to trigger a kernel bug, causing a system...

CGA-J4V7-HWX9-QH36

Bulletin has no description...

CVE-2016-10308

creationtimestamp| type| source ---|---|--- 2026-06-26 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp74juulxm2r...

MINI-VRMP-P92C-RQ45

Bulletin has no description...

MINI-GR3X-CWG5-V2P3

Bulletin has no description...

MINI-GJWJ-P42H-GR75

Bulletin has no description...

SUSE CVE-2026-53017

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix data loss caused by incorrect use of natentry flag Data loss can occur when fsync is performed on a newly created file before any checkpoint has been written concurrently with a checkpoint operation. The scenario is as...

SUSE CVE-2026-53242

In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in sndpcmdrain on linked streams sndpcmdrain uses initwaitqueueentry which does not clear entry.prev/next, and addwaitqueue with a conditional removewaitqueue that is skipped when tocheck...

PT-2026-52976

Name of the Vulnerable Software and Affected Versions Bento4 versions prior to 1.8.9 Description A stack overflow occurs in the AP4 Array::EnsureCapacity component. This issue allows an attacker to trigger a Denial of Service DoS by providing a specially crafted MP4 file. Recommendations Update t...

CVE-2026-36908

A stack overflow in the AP4Array::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

freerdp security update

2:2.11.7-7.3 - Lock appWindow to fix use-after-free in RAIL mode CVE-2026-25952 Resolves: RHEL-159860 2:2.11.7-7.2 - Fix double free in xfrailwindowcommon cleanup CVE-2026-26986 - Fix growth of preallocated buffers CVE-2026-27951 - Fix heap-buffer-overflow in bitmapcacheput CVE-2026-29775 - Add D...

The vulnerability of the strcpy() function (/goform/getOneApConfTempEntry) in the UTT HiPER 810G router software allows a attacker to cause a service failure.

The vulnerability of the strcpy function /goform/getOneApConfTempEntry in the UTT HiPER 810G router software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

GO-2026-5663 Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server

Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server...

GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf

androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...

GO-2026-5443 Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg...