PT-2026-90096

In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr-id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This...

Linux Distros Unpatched Vulnerability : CVE-2026-57229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - suricata - None Ubuntu Linux - smtp: evasion due to incomplete state reset CVE-2026-57229 Note that Nessus relies on the presence of the package ...

Linux Distros Unpatched Vulnerability : CVE-2026-57223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - suricata - None Ubuntu Linux - windows: unquoted LocalSystem service ImagePath CVE-2026-57223 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2026-57222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - suricata - None Ubuntu Linux - ippair: IPv4/IPv6 hash collision can reuse wrong IPPair state CVE-2026-57222 Note that Nessus relies on the presen...

Linux Distros Unpatched Vulnerability : CVE-2026-57225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - suricata - None Ubuntu Linux - datasets: NULL dereference on unexpected ndjson files CVE-2026-57225 Note that Nessus relies on the presence of th...

openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21811-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21811-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

Linux Distros Unpatched Vulnerability : CVE-2026-57227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - suricata - None Ubuntu Linux - mqtt: unbounded number of messages per tx CVE-2026-57227 Note that Nessus relies on the presence of the package as...

PT-2026-90005

🚨 CVE-2026-87910 When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the...

CVE-2021-41773

CVE-2021-41773 Apache HTTPサーバーの脆弱性（2.4.49のみで動作） 必要な設定 httpd.conf root@kitploit: ... LoadModule cgimodule modules/modcgi.so uncomment this line ... AllowOverride none Require all denied comment out this line or set Require all granted ... 参照...

CVE-2023-4911

CVE-2023-4911-Looney-Tunables Looney Tunables ローカル権限昇格 CVE-2023-4911 ワークショップ 教育目的のみ リンク: IPPSECのビデオ Qualsysのブログ記事 Qualsysの技術詳細 エクスプロイトPOC Pythonスクリプト GLIBCソース GLIBCチューナブルのドキュメント 説明 ld.soとは？ コンピューティングにおいて、動的リンカーとは、実行可能ファイルが実行される際に、その実行ファイルが必要とする共有ライブラリをロードしてリンク...

auth v2.197.0

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

GHSA-F8G7-2XJC-7MFH rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

GHSA-3G9Q-V48F-HH9W Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

GHSA-4QPV-39HG-F7FX @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

@argos-ci/core: CI Branch Name OS Command Injection

CI Branch Name OS Command Injection in @argos-ci/core Summary @argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow...