Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skips inactive planes within ModeSupportAndSystemConfiguration. Reason Coverity reported a memory issue involving illegal access attempts. How The inactive planes are skipped...

CVE-2026-105213

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

PT-2026-104637

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fixed information leakage in triggered buffers. The “buffer” local array is used to push data to user space from a triggered buffer. However, values for inactive channels are not set, as the function...

Astra Linux – Vulnerability in libvirt

A flaw was discovered in libvirt. External inactive snapshots of shut-down virtual machines are created as being accessible to everyone on the network, allowing unprivileged users to inspect the contents of the guest operating systems. This leads to an information disclosure vulnerability...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: adc: rockchipsaradc: fixed information leakage in the triggered buffer. The “data” local struct is used to push data to user space from a triggered buffer. However, it does not set values for inactive channels, as it only us...

EUVD-2026-75888

Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully...

GHSA-MF8R-WM2W-F8C5 phpMyFAQ public FAQ APIs expose inactive FAQ content

Affected Product phpMyFAQ Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: current main / 4.2-style source, API v4.0, for GET /api/v4.0/faqs/tags/tagId when api.onlyActiveFaqs=true. Patched Versions 4.1.5. Description The public FAQ API applies inconsistent active =...

CVE-2026-65822

In ERPNext versions before 15.116.0 and 16.23.0, the Inactive Customers report (inactive_customers.py) passes an unvalidated doctype filter directly into raw SQL via get_sales_details and get_last_sales_amt, enabling authenticated users to extract sensitive data and manipulate queries. CISA repor...

CVE-2026-72189 ntfs: fail attrlist updates when the superblock is inactive

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive genericshutdownsuper clears SBACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTELIST attribute,...

PT-2026-72377

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic shutdown super clears SB ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE LIST attribute, ntfs evic...

CVE-2026-73405

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

PT-2026-71083

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The token required decorator used by the Pub/Sub interface authenticated requests solely by matching the...

CVE-2026-60053

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

CVE-2026-70589

Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...

CVE-2026-18817 Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper...

CVE-2026-18817

CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...

CVE-2026-18817 Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper...

CVE-2026-18817

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper...

CVE-2026-18817 Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper...