CVE-2026-73409: Observable Discrepancy

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...

SUSE SLES12 Security Update : runc (SUSE-SU-2026:3428-2)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3428-2 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updat...

Linux Distros Unpatched Vulnerability : CVE-2026-68167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the...

PT-2026-85340

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jv8v-xq2h-657v. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that...

fs/ntfs3 Component DoS

The vulnerability of the fs/ntfs3 component in the Linux operating system is related to the use of an uninitialized resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

fs/ntfs3 Component DoS

The vulnerability of the fs/ntfs3 component in the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE SLES15 Security Update : runc (SUSE-SU-2026:3433-2)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3433-2 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275...

CVE-2026-68149

A flaw was found in the Linux kernel. The forgetcachedacl helper function, intended to manage Access Control List ACL caching, incorrectly invalidates the ACLDONTCACHE state. This can lead to a Fuse Filesystem in Userspace filesystem returning stale cached ACL values. Consequently, this could...

CVE-2026-73226

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

EUVD-2026-56919

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-73226

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-62793 Windows NTFS Information Disclosure Vulnerability

...

CVE-2026-65784 Windows NTFS Information Disclosure Vulnerability

...

CVE-2026-65784

CVE-2026-65784 describes an out-of-bounds read in the Windows NTFS subsystem that allows an authorized local attacker to disclose information. The CVSS v3.1 base metrics assign a 5.5 (Medium) score with local attack vector , low attack complexity , and low privileges required , with no user inter...

CVE-2026-62796 Windows NTFS Information Disclosure Vulnerability

...

EUVD-2025-210686

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure through the Chrome DevTools workspace endpoint in packages/nitro-server/src/index.ts. An attacker can retrieve the project’s absolute filesystem root and...

CVE-2026-72602

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...