CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

UBUNTU-CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2026-77611

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler...

CVE-2025-55182_CVE-2025-66478

CVE-2025-55182 - Esecuzione Remota di Codice nei Server Components di Next.js/React Panoramica Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2025-55182, una vulnerabilità critica di Esecuzione Remota di Codice RCE che interessa i Server Components di React nelle versioni 19.x...

CVE-2026-71327

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its Kubernetes Gateway API provider incorrectly generates unique identifiers for routes and services. This vulnerability allows an attacker to create conflicting routes, which can then overwrite the backend services...

CVE-2026-79262

A flaw was found in Google Chrome. Incorrect authorization in the Network component allowed a remote attacker to bypass the web origin policy by crafting a malicious HTML page. This bypass could enable an attacker to access restricted resources or data from other origins, potentially leading to...

CVE-2026-79038

A flaw was found in WebProtect in Google Chrome. This incorrect authorization vulnerability allows a remote attacker to obtain sensitive information by tricking a user into visiting a specially crafted HTML page...

CVE-2026-48549

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute...

CVE-2026-79902

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array VLA on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting i...

UBUNTU-CVE-2026-79902

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array VLA on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting i...

CVE-2026-79902

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array VLA on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting i...

CVE-2026-75977 Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey function that uses the current user's identity instead of the cookie username...

CVE-2026-75977

Mang Board WP WordPress plugin (all versions ≤ 2.3.7 ) suffers from a Missing Authorization vulnerability via authentication cookie forgery. The root cause is flawed HMAC generation in mbw_get_hash_key(), which uses the current user's identity instead of the cookie's username parameter when a Wor...

CVE-2026-15365

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...

CVE-2026-58108 Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...

CVE-2026-15365

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...

EUVD-2026-66295

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...

CVE-2026-15365

CVE-2026-15365 affects vivo Kids Mode , where a pop-up logic flaw in a certain feature allows users to bypass password verification and access Quick Apps outside the app. The vulnerability requires a physical attack vector and is scored CVSS 4.0 Base 2.4 (LOW) , with low impact on confidentiality...

USN-8681-1: OpenJDK 25 vulnerabilities

It was discovered that the JSSE component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 25 did not correctly authorize users. A remote attack...

Linux Distros Unpatched Vulnerability : CVE-2026-79005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass...