GHSA-XQ8M-7C5P-C2R6 Auth0 Next.js SDK has Improper Proxy Cache Lookup

Description In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Which Projects are Affected? Users are affected if they meet all of the following preconditions: -...

Auth0 Next.js SDK has Improper Proxy Cache Lookup

Description In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Which Projects are Affected? Users are affected if they meet all of the following preconditions: -...

CVE-2026-1089

The CVE-2026-1089 affects Fortra’s GoAnywhere MFT prior to version 7.10.0, where a user‑controlled HTTP header can trigger DNS lookups, DNS rebinding, and information disclosure. The vulnerability involves an HTTP header handling flaw that can be exploited by an unauthenticated network attacker (...

CLSA-2026-1776762459 harfbuzz: Fix of CVE-2023-25193

CVE-2023-25193: optimize looking back for base glyphs in hb-ot-layout-gsubgpos-private.hh...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011265)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011265 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfsrelocatesyschunks The unhandled case in...

PT-2026-33979

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013051)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013051 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfsmdtgetblock If the disk image that nilfs2 mounts is corrupted a...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013208)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013208 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Cali...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013189)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013189 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in ttydriverlookuptty When specifying an invalid console= device li...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006953)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006953 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin: Use last transaction's pmd-root when commit failed Recently we found a softlock up probl...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013381)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013381 advisory. In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix null pointer dereferencing in ofunittestfindnodebyname when kmalloc fail to...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011242)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011242 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin: Use last transaction's pmd-root when commit failed Recently we found a softlock up probl...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010950)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010950 advisory. In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in ttydriverlookuptty When specifying an invalid console= device li...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011114)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011114 advisory. In the Linux kernel, the following vulnerability has been resolved: ubi: ubiwlputpeb: Fix infinite loop when wear-leveling work failed Following process will trigger...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011158)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011158 advisory. In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix unbalanced of node refcount in regulatordevlookup I got the the following...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-010859)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010859 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfsmdtgetblock If the disk image that nilfs2 mounts is corrupted a...

CVE-2026-40896

CVE-2026-40896 concerns OpenProject before version 17.3.0, where a user with the low-privilege permission manage_agendas in any project can inject agenda items into meetings across other projects due to an unscoped section lookup vulnerability. The attack does not require knowledge of the target ...

CVE-2026-40896 OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with manageagendas permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target...

CVE-2026-40896 OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with manageagendas permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target...

Server-Side Request Forgery (SSRF)

web3.py is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to web3.py directly processing contract-supplied URLs in its CCIP Read/OffchainLookup EIP-3668 implementation without validating the destination, which allows an attacker to craft a malicious smart contract that...