CVE-2026-102297 ZoneMinder before 1.38.4 Incorrect Authorization in frames API index

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

CVE-2026-102297

ZoneMinder versions before 1.38.4 are vulnerable to an authorization bypass in the FramesController index endpoint . Authenticated users possessing Events view permission can call the frames API to list records from monitors they are not authorized to access. This flaw allows for the disclosure o...

CVE-2026-102297 ZoneMinder before 1.38.4 Incorrect Authorization in frames API index

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

EUVD-2026-88400

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-55160

The self-hosted RSS reader Stringer is vulnerable to an unrestricted Server-Side Request Forgery (SSRF) in versions prior to commit 75cb095 . This flaw allows any authenticated user to compel the server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud meta...

CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

EUVD-2026-88316

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

BIT-MONGODB-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-55160: Server-Side Request Forgery (SSRF)

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-102297: Incorrect Authorization

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

PT-2026-102393

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.38.4 Description Authenticated users with Events view permission can bypass per-monitor access restrictions via the 'FramesController index' endpoint. This allows them to list frame records from monitors they are...

Important: 389-ds-base

Issue Overview: A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and...

PT-2026-102289

Name of the Vulnerable Software and Affected Versions Stringer versions prior to commit 75cb095 Description An unrestricted Server-Side Request Forgery SSRF allows authenticated users to force the server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud...

PT-2026-99912

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions prior to 0.16.2 SUSE Rancher Fleet versions prior to 0.15.7 SUSE Rancher Fleet versions prior to 0.14.11 SUSE Rancher Fleet versions prior to 0.13.16 Description A privilege mismatch exists where updates to namespac...

CVE-2026-96282

The Flatpak software is vulnerable to a file existence oracle and path traversal via extension metadata. A malicious Flatpak extension can probe the host filesystem to identify existing files and directories at arbitrary paths, potentially disclosing host directory listings to sandboxed applicati...

CVE-2026-96282

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...

CVE-2026-96282 Flatpak: flatpak: extension metadata path traversal file existence oracle

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...

CVE-2026-96282 Flatpak: flatpak: extension metadata path traversal file existence oracle

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...