168403 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-75007
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead ...
RHEL 9 : kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 (RHSA-2026:55837)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55837 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...
Linux Distros Unpatched Vulnerability : CVE-2026-74428
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rxrpc: Fix double unlock in rxrpcrecvmsg Fix a double unlock in rxrpcrecvmsg when dealing with OOB messages. CVE-2026-74428 Note that Nessus relies on the...
Linux Distros Unpatched Vulnerability : CVE-2026-74260
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfdupnetdev: add nfdevxmitrecursion helpers and use them Update nftdup and nftfwd to use the nfdevxmitrecursion helpers. This patch also disables BH...
PT-2026-78240
Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9 Description An authenticated user can modify backend-managed identity attributes via the 'PATCH /api/users/:id' endpoint. This occurs because the whitelist in the update.js controller allows mass assignment of...
Linux Distros Unpatched Vulnerability : CVE-2026-74259
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cifs: remove all cifs files before kill super Cifs files may be put into fileinfoputwq during umounting cifs. After umount done, cifsFileInfoputfinal is called,...
Linux Distros Unpatched Vulnerability : CVE-2026-75002
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privile...
Linux Distros Unpatched Vulnerability : CVE-2026-72387
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we s...
Linux Distros Unpatched Vulnerability : CVE-2026-74265
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: initialize gdma queue id to INVALIDQUEUEID managdcreatemanawqcq leaves queue-id as 0 from kzallocobj until manacreatewqobj assigns the...
CVE-2026-9859
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...
CVE-2026-9859 Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...
CVE-2026-9859 Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...
CVE-2026-9859
Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...
CVE-2026-9859
Mattermost Boards plugin (versions ≤11.7.6, ≤10.11.21, ≤11.8.3) fails to enforce PermissionManageBoardRoles on the batch endpoint's channelId field, allowing authenticated board editors to relink boards to arbitrary channels via crafted PATCH requests. CVSS 3.1 scores 6.5 (MEDIUM) for network-bas...
MINI-2G3X-3F79-GG59
Bulletin has no description...
MINI-44P8-68W5-3G93
Bulletin has no description...
CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...
CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...