ECHO-5F1F-E89D-BE0F

Bulletin has no description...

MINI-XJQ3-WRJX-4P82

Bulletin has no description...

ECHO-A9F1-E217-840B Kernel vulnerabilities are irrelevant in container environments.

Bulletin has no description...

ECHO-5C2D-B48F-6245

Bulletin has no description...

MINI-V8RM-34F2-FC9V

Bulletin has no description...

MINI-2CGX-G8H5-48FG

Bulletin has no description...

CVE-2026-35373

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms e.g., ln SOURCE... DIRECTORY. While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation...

CVE-2026-33597

A flaw was found in PowerDNS DNSdist. A crafted query containing an invalid DNS label can prevent the PRSD detection algorithm executed via DynBlockRulesGroup:setSuffixMatchRule or DynBlockRulesGroup:setSuffixMatchRuleFFI from being executed...

MINI-38H5-2JXV-C9GP

Bulletin has no description...

MINI-P8X7-397R-GJ9F

Bulletin has no description...

MINI-FG7J-9PC7-MVC7

Bulletin has no description...

MINI-9W88-VW27-7MW7

Bulletin has no description...

CVE-2026-30863 Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration...

CVE-2026-27898

A flaw was found in Vaultwarden, an unofficial Bitwarden compatible server. An authenticated regular user can exploit this by specifying another user’s cipher identifier cipherid and making a partial update request to the API. This action bypasses standard access controls, leading to the exposure...

MINI-GW49-R9HX-Q4V3

Bulletin has no description...

MINI-2R4J-P5F5-VMHX

Bulletin has no description...

ZITADEL's truncated opaque tokens are still valid

Summary Opaque OIDC access tokens in v2 format, truncated to 80 characters are still considered valid. ZITADEL uses a symmetric AES encryption for opaque tokens. The cleartext payload is a concatenation of a couple of identifiers, such as a token ID and user ID. Internally Zitadel has 2 different...

CVE-2026-26025 free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE 

free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation 5G mobile core networks. In versions up to and including 1.4.1, SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP UDP/8805 interface. No known upstrea...

CVE-2026-23025

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .ownercpu: 0 CPU: 0...

CVE-2026-22993

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL ptr issue after soft reset During soft reset, the RSS LUT is freed and not restored unless the interface is up. If an ethtool command that accesses the rss lut is attempted immediately after reset, it will...