CVE-2026-87859

creationtimestamp| type| source ---|---|--- 2026-09-11 09:21:21+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mvaahpudgk2t 2026-09-11 11:51:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gk3b4eixszvfv 2026-09-29 02:31:24+00:00| seen|...

CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

EUVD-2026-76026

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-85706

creationtimestamp| type| source ---|---|--- 2026-09-11 00:17:16+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mv7c2savxc2e 2026-09-11 04:02:56+00:00| seen| https://bsky.app/profile/whatsnew.fyi/post/3mv7ooemhtb2t 2026-09-11 12:08:20+00:00| seen|...

PT-2026-89996

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

PT-2026-90208

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the ocfs2 module of the Linux kernel. The functions ocfs2 validate dx leaf and ocfs2 validate dx root fail to bound the ocfs2 dx entry list counts...

PT-2026-90496

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Cross-Site Request Forgery CSRF occurs in the Express Clear Entries function. The issue exists because the controller records a failed CSRF token check but does not enforce it, allowing...

Xen: Stale TLB Entry Ahead of Page Scrubbing (XSA-511)

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-89452: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU object to qcomiommudevices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommudevicesysfsadd fails,...

PT-2026-90392

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd component where nfsd4 copy calls nfs4 init copy state before dup copy fields during an async COPY operation. This causes the s2s cp stateids IDR to point to memor...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

GHSA-66HP-WGXQ-6F5Q rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-80921

creationtimestamp| type| source ---|---|--- 2026-09-10 15:40:23+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117247496893618248 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-82779

creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:03+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...

CVE-2026-82768

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:30+00:00| seen| https://jvn.jp/en/vu/JVNVU99009004...

CVE-2026-87524

creationtimestamp| type| source ---|---|--- 2026-09-10 04:49:44+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-13 11:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvfhcrdfcs2f 2026-09-16 04:49:53+00:00| seen|...

CVE-2026-87485

creationtimestamp| type| source ---|---|--- 2026-09-10 04:48:15+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-16 04:48:54+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260916...