CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-51257

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

[SECURITY] [DSA 6405-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6405-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 31, 2026 https://www.debian.org/security/faq -...

CVE-2026-14927

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

SUSE SLED15 / SLES15 Security Update : python-urwid (SUSE-SU-2026:3425-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3425-1 advisory. This update for python-urwid fixes the following issue CVE-2026-9323: web session IDs generated by Screen.start are not...

SUSE CVE-2026-49339

gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 added an ownership check based on playlist.UserID. However, playlist.UserID is derived from the first path segment of the attacker-controll...

Security update for python-urwid

This update for python-urwid fixes the following issue CVE-2026-9323: web session IDs generated by Screen.start are not cryptographically secure bsc1271868. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:3425-1 Security update for python-urwid

This update for python-urwid fixes the following issue CVE-2026-9323: web session IDs generated by Screen.start are not cryptographically secure bsc1271868...

CLEANSTART-2026-KC30939 Security fixes in argo-workflows-fips 3.7.8-r2

Package argo-workflows-fips version 3.7.8-r2 fixes 7 vulnerabilities: ghsa-fw7p-63qq-7hpr, ghsa-q9hv-hpm4-hj6x, ghsa-9h8m-3fm2-qjrq, CVE-2026-26958, CVE-2026-1229...

CLEANSTART-2026-OI85339 Security fixes in tempo 2.8.3-r1

Package tempo version 2.8.3-r1 fixes 4 vulnerabilities: CVE-2026-33186, CVE-2026-34986, ghsa-p77j-4mvh-x3m3, ghsa-78h2-9frx-2jm8...

CLEANSTART-2026-AJ02810 Security fixes in kserve-modelmesh 0.12.0-r0

Package kserve-modelmesh version 0.12.0-r0 fixes 20 vulnerabilities: CVE-2026-24281, CVE-2026-24308, CVE-2026-33870, CVE-2026-33871, ghsa-7xrh-hqfc-g7qr...

PT-2026-66606

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The payment webhook at the POST / locale/update-payment endpoint accepts the id and orderId...

EUVD-2026-50394

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

CVE-2026-16543 Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

EUVD-2026-50353

Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...

CVE-2026-65884

Product: Joomla Extension Gridbox (balbooa.com). Vulnerability: Privilege Escalation in Gridbox

CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

CVE-2026-64643

A flaw was found in Next.js. Unauthenticated users can exploit this vulnerability by accessing publicly served client artifacts, which may disclose Server Action IDs. This bypasses authentication on pages where these endpoints are used, leading to information disclosure. While primarily an...

Security update for libssh

This update for libssh fixes the following issues: CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. CVE-2026-59844: denial of service via oversized SFTP read length bsc1272165. CVE-2026-59845: denial of service via unchecked ProxyCommand fork failure bsc127216...