cisco-ios-xe-implant-scanner

Cisco IOS XE Implant Scanner On October 23, 2023, with all implants no longer responding to requests to /webui/logoutconfirm.html, Fox-IT developed a new way to determine if a system is compromised or not. In particular, instead of responding to requests with a redirect to the login, the attacker...

CVE-2026-98514

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

PT-2026-116733

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate init On the ttm bo reserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm gem objec...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: A null pointer check should be added for getfirstactivedisplay. The function modhdcphdcp1enableencryption calls the function getfirstactivedisplay, but does not check its return value. The return value is a null...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: hwmon: Handle failure to register sensor with thermal zone correctly If an attempt is made to a sensor with a thermal zone and it fails, the call to devmthermalzoneofsensorregister may return -ENODEV. This may result in crashes...

PT-2026-109494

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.59 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecti...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: A null pointer check was added in modhdcphdcp1createsession. The function modhdcphdcp1createsession calls the function getfirstactivedisplay, but does not check its return value. The return value is a null pointe...

EUVD-2026-92108

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

CVE-2026-105215

ZITADEL versions before 3.4.14 and 4.x before 4.16.2 are vulnerable to an authentication bypass within the hosted Login V1 UI . The root cause is that the 'external account not found' registration endpoint trusts client-supplied external identity fields without requiring a completed IdP callback ...

PT-2026-104639

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

CVE-2026-105215: Authentication Bypass by Spoofing

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

Rocky Linux 9.6 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1340)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261340 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-41651. Tenable has extracted the preceding descriptio...

NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers vulnerability discovered by ? in WordPress Npm fastify versions = 4.0.0, 5.12.2...

EUVD-2026-70988

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers...

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...

GHSA-P68Q-WCHP-6FH7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nilfs2: A general protection fault occurred in nilfsbtreeinsert. If nilfs2 reads a corrupted disk image and attempts to read a B-tree node by calling nilfsbtreegetblock against an invalid virtual block address, it returns -ENOENT...

CVE-2026-76169

A flaw was found in fastify. Malformed URLs can be routed to a custom not-found handler of a different plugin, bypassing the intended security checks. This allows an unauthenticated attacker to access and read the full response of an authentication-protected private fallback, leading to informati...

CVE-2026-76169

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...