CVE-2026-78255

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

CVE-2026-78179

creationtimestamp| type| source ---|---|--- 2026-08-24 08:15:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-78179...

CVE-2026-71201

A flaw was found in OpenStack Ironic. A project reader can exploit this vulnerability by sending a specially crafted request to the Ironic service. This allows the reader to access Portgroups that are assigned to Nodes belonging to or leased by other projects, leading to unauthorized information...

EUVD-2026-64746

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues: grafana updated from version 11.6.14+security04 to version 12.4.5: Security fixes: CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints bsc1271331 - version 12.4.4 CVE-2025-12141: Fixed information leakage...

CVE-2026-8173

The web GUI of Murrelektronik Xelity switches is affected by an information disclosure vulnerability. When an authenticated administrator uses the 'Copy learned MAC Addresses' function, MAC addresses from the device's MAC address table are logged. Due to improper generation of error messages , an...

CVE-2026-8173 Information Disclosure via 'Copy learned MAC Addresses' Function

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web...

Oracle WebLogic Server - Remote Command Execution

Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See...

MAL-2026-14391 Malicious code in fund-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c5f9f0536151a173aa211b9b5f2972e68aee3043132adccdb3695947b16672 Package declares a preinstall script node index.js that fires unconditionally on npm install. index.js reads installer-side identifiers via...

openssl: SSL_select_next_proto buffer overread

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSLselectnextproto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called...

webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information

A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...

Security update for Multi-Linux Manager Monitoring stack

This update fixes the following issues: prometheus-postgresexporter: CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and privilege escalation bsc1248699 golang-github-prometheus-alertmanager: CVE-2026-39821: Fix validation bypass and...

SUSE-SU-2026:3714-1 Security update for Multi-Linux Manager Monitoring stack

This update fixes the following issues: prometheus-postgresexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 and prevent validation bypass and privilege escalation bsc1248699 golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass an...

SUSE-SU-2026:3713-1 Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues: golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 bsc1266615 golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4: - Security fixes: -...

Important: Red Hat Security Advisory: python-urwid security update

An update for python-urwid is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

Important: Red Hat Security Advisory: python-urwid security update

An update for python-urwid is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information

A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...