webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information

A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

CVE-2026-78204

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78203

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204

Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...

EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78203 Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

CVE-2026-78203

Ghostwriter before 7.1.2 contains a cross-client authorization flaw in the report template swap endpoint . The endpoint fails to validate template ownership, and because template primary keys are sequential, an authenticated attacker can enumerate and attach templates belonging to other clients t...

EUVD-2026-64678

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

ROS-20260824-73-0009

The vulnerability in the libfreerdp/codec/h264.c file of the H.264 decompression subsystem of the RDP client FreeRDP relates to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to cause service failures and expose sensitive information...

The vulnerability of the ceph_handle_authreply() function in the net/ceph/auth.c module of the Linux operating system allows a hacker to gain access to protected information or cause a service failure.

The vulnerability of the cephhandleauthreply function in the net/ceph/auth.c module of the Linux kernel is related to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to gain access to protected information or cause service...

RHEL 9 : firefox (RHSA-2026:58897)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58897 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

CVE-2026-56136

NTFS-3G (through 2026.2.25) contains an out-of-bounds read in ntfs_ir_nill() in libntfs-3g/index.c. An attacker can trigger the flaw by mounting a malicious NTFS image and creating a file with a crafted name, potentially disclosing confidential information from the ntfs-3g process memory. The CVS...

RHEL 9 : assertj-core (RHSA-2026:58957)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58957 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...

The vulnerability of the `__ioam6_fillTraceData()` function in the `net/ipv6/ioam6.c` module of the Linux operating system allows an attacker to access protected information or cause a service failure.

The vulnerability of the ioam6fillTraceData function in the net/ipv6/ioam6.c module of the Linux operating system’s kernel is related to incorrect validation of input data. Exploiting this vulnerability may allow an attacker, acting remotely, to gain access to protected information or cause servi...

RHEL 8 : python-urwid (RHSA-2026:58562)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58562 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 9 : python-urwid (RHSA-2026:58955)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58955 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RockyLinux 10 : python-urwid (RLSA-2026:58561)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58561 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description blo...