PT-2026-73035

Name of the Vulnerable Software and Affected Versions opensourcepos Open Source Point of Sale versions prior to 3.4.3 Description An issue exists in the Login Endpoint component within the Login::index function of the app/Config/Filters.php file. This flaw allows for the improper restriction of...

Linux Distros Unpatched Vulnerability : CVE-2026-72243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure...

PT-2026-72504

In the Linux kernel, the following vulnerability has been resolved: dm era: fix NULL pointer dereference in metadata open metadata open returns NULL when kzalloc obj fails, but the caller era ctr only checks IS ERRmd. Since IS ERRNULL returns false, the NULL pointer is treated as a valid result a...

PT-2026-72749

In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse lock across IDR lookup in open path vduse dev open looks up struct vduse dev through the IDR and then acquires dev-lock only after vduse lock has been dropped. This leaves a window where a concurrent VDUSE DESTR...

Linux Distros Unpatched Vulnerability : CVE-2026-74574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still...

PT-2026-72431

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description SELinux failed to verify connect-related permissions when TCP Fast Open was utilized. This occurred because the system was not updated to ensure these checks were performed during the...

CVE-2026-73653 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: tileserver-gl, jitsucom-jitsu...

CVE-2026-49826

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

K000162929: Spring Security Authorization Server vulnerability CVE-2026-41008

Security Advisory Description Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

EUVD-2026-58716

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2026-49826 Concourse login flow has an open redirect issue

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2026-49826 Concourse login flow has an open redirect issue

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2026-49826 Concourse login flow has an open redirect issue

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2026-49826

Summary : CVE-2026-49826 affects Concourse prior to version 8.2.3, where an attacker can craft a URL that redirects a user from the Concourse web server to an arbitrary site (open redirect). Root cause / technical detail : The issue is tied to the login flow and is described in sources as a URL/r...

CVE-2026-49826

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

DEBIAN-CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

UBUNTU-CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...