CVE-2026-72211

A flaw was found in the Linux kernel's NTFS file system driver. When the driver attempts to reparent an index root, it can update metadata to reflect a larger size before the actual data structure is resized. If this resize operation fails, the file system can enter an inconsistent state. This...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

CVE-2026-72160

A flaw was found in ocfs2 Oracle Cluster File System version 2 in the Linux kernel. This vulnerability arises from insufficient validation of on-disk inode metadata, specifically the imode type bits. A local attacker could exploit this by crafting a malformed disk inode with a non-canonical POSIX...

[SECURITY] [DLA 4744-1] calibre security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4744-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 18, 2026 https://wiki.debian.org/LTS -...

PT-2026-80359

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList...

PT-2026-77139

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.26.3 Description A server-side request forgery SSRF issue exists in the agent workflow "Invoke" component located in agent/component/invoke.py. The component constructs outbound request URLs using canvas configurati...

PT-2026-76920

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

PT-2026-80463

uniget CLI: Metadata signature verification only runs when UNIGET IGNORE METADATA SIGNATURE is set in gitlab.com/uniget-org/cli...

PT-2026-80295

Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...

PT-2026-80423

Unsafe file permission restoration from metadata in github.com/rclone/rclone...

CVE-2026-71303: Server-Side Request Forgery (SSRF)

Lemur manages TLS certificate creation. Prior to 1.9.3, validateacmeurl enforced ACMEDIRECTORYHOSTALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the...

CVE-2026-75898: Server-Side Request Forgery (SSRF)

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

CVE-2026-74904: Missing Authorization

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

CVE-2026-50167: Authorization Bypass Through User-Controlled Key

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

tailscale -- Insufficient validation of 4via6 subnet router destinations

Tailscale team reports: Insufficient validation of 4via6 subnet router destinations permitted access to host-scoped addresses, including cloud metadata and loopback services. TS-2026-11...

PT-2026-76944

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

Linux Distros Unpatched Vulnerability : CVE-2026-72108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in t...

Linux Distros Unpatched Vulnerability : CVE-2026-72426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead sta...

Linux Distros Unpatched Vulnerability : CVE-2026-72186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap i...

VulnCheck KEV: CVE-2026-64849

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive responsestatus and responsebody...