MagicMirror: ssrf calendar .js

Vulnerability — SSRF via ADDCALENDAR MagicMirror² calendar Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint |...

GO-2026-6192 Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass in github.com/traefik/traefik

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass in github.com/traefik/traefik...

GO-2026-6198 Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2026-6209 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik...

BIT-GITLAB-2026-19228 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information...

BIT-GITLAB-2026-18433 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

Linux Distros Unpatched Vulnerability : CVE-2026-72127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netdev-genl: report NAPI thread PID in the caller's pid namespace netdevnlnapifillone reports the NAPI kthread PID in NETDEVANAPIPID using taskpidnr, which...

Linux Distros Unpatched Vulnerability : CVE-2026-72090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then...

Linux Distros Unpatched Vulnerability : CVE-2026-72430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actct: fix nfconnlabels leak on two error paths tcfctfillparams calls nfconnlabelsget setting putlabels when TCACTLABELS is present, but two later...

CVE-2026-72136

A flaw was found in the Linux kernel's xfrminterface component. A local attacker with specific network administration privileges in one network namespace could exploit this vulnerability to modify the configuration of a network interface in a different network namespace where they are not...

CVE-2026-72061

A flaw was found in the Linux kernel. An incorrect permission check in the ipip6changelink function, which manages IPv6 over IPv4 SIT tunnels, allows a local attacker to bypass intended security restrictions. A user with administrative capabilities CAPNETADMIN in one network namespace a virtualiz...

CVE-2026-72055

A flaw was found in the Linux kernel's ip6vti component, which handles IPv6 Virtual Tunnel Interfaces. A local attacker with certain network administration privileges in one isolated network environment network namespace could exploit this vulnerability. This allows them to modify the configurati...

CVE-2026-72054

A flaw was found in the Linux kernel's ipvti component. An attacker with CAPNETADMIN privileges in one network namespace netns but not in another, can exploit an insufficient capability check in the vtichangelink function. This allows them to rewrite a Virtual Tunnel Interface VTI tunnel that...

CVE-2026-72053

A flaw was found in the Linux kernel's ipip networking component. A local attacker with certain network administration capabilities in one network namespace could exploit an insufficient permission check in the ipipchangelink function. This could allow them to modify the configuration of a networ...

CVE-2026-72051

A flaw was found in the Linux kernel's IPv6 tunnel ip6tunnel handling. A local attacker, privileged in one network namespace but not another, could exploit a missing capability check in the ip6tnlchangelink function. This vulnerability allows the attacker to modify an IPv6 tunnel residing in a...

ANT-2026-MHJX7J31 · typo3 · XSS

xss medium CVE-2026-47345 GHSA-p5j5-4j3q-8mq8 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-MHJX7J31: Stored XSS in TYPO3...

BIT-OPENBAO-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

PT-2026-73387

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100569)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100569 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6siocdevprivate. After patch 1/2 in this series, vti6update unlink...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100326 advisory. In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix UAF on dstops when IFFXMITDSTRELEASE is cleared and napitx is false A UAF issue...