DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74595 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74595

CVE-2026-74595 is a Linux kernel vulnerability in the fscrypt subsystem, specifically in fscrypt_ioctl_set_policy(). The function calls inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap of the mount on which the ioctl was issued. On idmapped mounts (e.g., ext4, f2fs), this causes ...

EUVD-2026-64532

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

PT-2026-79600

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscrypt ioctl set policy fscrypt ioctl set policy calls inode owner or capable with &nop mnt idmap before allowing an encryption policy to be set, instead of the idmap of the...

kbd security update

An update is available for kbd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kbd packages provide tools for managing console behavior on a Linux system,...

kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

Moderate: Red Hat Security Advisory: kbd security update

An update for kbd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

GHSA-H58C-XCCX-75M3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

Moderate: kbd security update

The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fixes: kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-726...

CVE-2026-76399

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language SPL using the permissions of the search owner, which could allow access to all relevant data and affect system integrity. Th...

CVE-2026-18544

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...

EUVD-2026-62851

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...

GHSA-JFJ5-WRJ9-63X4 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...

PT-2026-78692

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description An authenticated low-privileged user can cause the platform to authenticate to an attacker-controlled SSH server, leading to the disclosure of another user's stored SSH password or private-key materia...