MINI-7PWV-V949-P58H

Bulletin has no description...

CVE-2026-49342

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:42+00:00| published-proof-of-concept| https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8...

CVE-2026-49339

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:09+00:00| published-proof-of-concept| https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448...

Photon OS 4.0: Erlang PHSA-2026-4.0-1038

An update of the erlang package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-1038. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-53225

Name of the Vulnerable Software and Affected Versions mcp Python SDK versions prior to 1.27.2 Description Principal confusion exists in the HTTP transports of the mcp Python SDK. Specifically, the SSE and Streamable HTTP stateful mode routed sessions fail to verify if the principal matches the...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the id parameter in playlist operations. An attacker can access or delete other users' playlists, and probe for the existence of arbitrary files by supplying a crafted base64-encoded...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the ServeCreateOrUpdatePlaylist process. An attacker can overwrite or create arbitrary files on the host system by supplying a crafted playlist ID that resolves to an...

CVE-2026-0685

creationtimestamp| type| source ---|---|--- 2026-06-26 23:20:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpa3iaoqql2z...

EUVD-2026-37950

Relyra SAML SignatureValue not cryptographically verified - authentication bypass...

CVE-2026-50137

Budibase prior to 3.39.0 is affected by CVE-2026-50137: unauthenticated POST /api/attachments/:datasourceId/url allows anonymous callers to mint 15-minute AWS S3 pre-signed PUT URLs using the datasource’s IAM credentials, with the bucket not pinned to the datasource. The attack discloses the targ...

GHSA-GM7F-V959-FR2G Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Summary The global policy read endpoint GET /api/latest/fleet/policies/policyid performs authorization against an empty fleet.Policy struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the global scope. This allows a use...

CVE-2026-46601 vulnerabilities

Vulnerabilities for packages: mattermost, seaweedfs, kubescape, pdfcpu, mailpit, gitea, rclone, bento, ollama...

DEBIAN-CVE-2026-53310

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix cross-fabric target timeout lookup When a fabric receives an error interrupt, the error may have occurred on a different fabric. The target timeout lookup was using the wrong base address cbb-regs with offsets...

CVE-2026-42390

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation...

GHSA-4C8J-MGM4-QQVP

creationtimestamp| type| source ---|---|--- 2026-06-26 19:42:06+00:00| seen| https://gist.github.com/alon710/89044faa74c1d9de479703a9098fa939 2026-07-29 08:01:20+00:00| seen| https://t.me/nxblog/1745 2026-07-30 00:02:09+00:00| seen| https://t.me/nxblog/1745 2026-08-01 20:00:05+00:00| seen|...

CVE-2026-44731 OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user account...

EUVD-2026-39859

In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pciname for debugfs directory naming Use pcinamepdev for the per-device debugfs directory instead of hardcoded "0" for PFs and pcislotnamepdev-slot for VFs. The previous approach had two issues: 1. pcislotname...

CVE-2026-53317 wifi: mt76: mt7921: Place upper limit on station AID

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Place upper limit on station AID Any station configured with an AID over 20 causes a firmware crash. This situation occurred in our testing using an AP interface on 7922 hardware, with a modified hostapd,...

CVE-2026-53283

CVE-2026-53283 concerns the Linux kernel AMD IOMMU driver. The issue arises when the inlined check path in __rlookup_amd_iommu() performs an out-of-bounds read on rlookup_table[devid] for a PCI device whose BDF isn’t described by IVRS. Prior to the commit that changed kvalloc() usage, the over-re...

CVE-2026-44732

OpenProject vulnerability CVE-2026-44732 affects the web-based project management tool prior to versions 17.3.2 and 17.4.0. The flaw occurs in the /api/v3/documents/{id} PATCH endpoint, where attacker-controlled attributes are applied to the persisted record before authorization checks, allowing ...