EUVD-2026-55662

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting...

CVE-2026-72900

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database...

CVE-2026-72732 Discourse: Templates endpoint exposes hidden tag names

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...

CVE-2026-71577

CVE-2026-71577 affects multicluster-global-hub. During a ManagedClusterMigration, the system grants all managed hubs read access to a shared communication topic, enabling a compromised hub to intercept bootstrap kubeconfigs containing API server tokens intended for other hubs. These tokens have a...

CVE-2026-71577 Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server token...

CVE-2026-63623 Libvirt: information disclosure via world-readable storage volume images during clone/convert

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

CVE-2026-63623

CVE-2026-63623 affects libvirt during storage volume clone or convert operations, where qemu-img creates new volume images with overly permissive file permissions, temporarily making them world-readable and allowing local users to read the full guest disk contents. This could lead to sensitive in...

CVE-2026-71577

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server token...

CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

CVE-2026-72726

CVE-2026-72726 affects the Discourse open-source discussion platform. Before versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. This is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Rem...

CVE-2026-56620

Technical details such as affected products, versions, root cause, or exploit information are not publicly provided in the supplied documents. Monitor for updates from official disclosures.

CVE-2026-72723

CVE-2026-72723 (Discourse) : The issue affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. SiteSerializer.anonymous_default_navigation_menu_tags exposes tag names and descriptions for tags restricted by categories, category tag groups, or tag-group permissions to unaut...

CVE-2026-72722

Discourse (open‑source discussion platform) contains a vulnerability in TopicLink processing prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The affected components are TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup. The root cause is that Guardia...

CVE-2026-48048

XWiki Platform is vulnerable due to an insufficient patch for GHSA-5cf8-vrr8-8hjm in the LiveTableResults endpoint. Affected versions are 6.2.1 and earlier than 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17. By sending slightly modified parameters to LiveTableResults, an attacker can reconstruct a us...

CVE-2026-72760

Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, getfollowing includes the followed user's email field in the API response alongside their name, user ID, and follow date. Becaus...

CVE-2026-72759

In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...

CVE-2026-6373

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

EUVD-2026-55620

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

EUVD-2026-55453

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

CVE-2026-68326

CVE-2026-68326 (Linux mwifiex bound uAP association event IEs to the event buffer) : The issue arises in the mwifiex driver within the Linux kernel when handling EVENT_UAP_STA_ASSOC. The code exposes the association request IEs (assoc_req_ies) via a length calculation that uses event->len, whi...