PT-2026-89673

🚨 CVE-2026-78124 strongSwan 5.0.2 through 6.0.7 allows PKCS7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime. 🎖@cveNotify...

PT-2026-89087

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci ecam create maps each bus segment separately and relies on the -add bus callback p...

PT-2026-88958

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-81531

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers

An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker...

CVE-2026-81531

CVE-2026-81531 affects Omada Controller (multiple versions, per the CNA title). An API endpoint intended for Controller initialization remains accessible after the initialization process completes, allowing unauthenticated remote users to query it and obtain account-related information . Successf...

CVE-2026-86737

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

EUVD-2026-72873

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-86737

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. An authenticated attacker can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets. The vulnerability i...

CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-86737 snipe-it before 8.7.0 Missing Authorization via barcode endpoint

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-73320 XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query t...

CVE-2026-73320

XenForo before 2.3.13 is affected by an unauthenticated information disclosure vulnerability in the unfurl endpoint . Attackers can supply predictable auto-increment primary key IDs to retrieve rendered preview HTML, original URLs, and query strings from private conversations and other restricted...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86539

knowns through version 0.33.0 contains a server-side request forgery (SSRF) vulnerability in the POST /api/embedding-models/test endpoint. The endpoint issues outbound requests to caller-supplied destinations without validating the target, allowing unauthenticated attackers to enumerate internal ...