CVE-2026-104964: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

PT-2026-106034

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Two endpoint families fail to verify that nested resource identifiers belong to the workspace and project specified in the URL. An authenticated user can read or modify estimates from another workspace...

PT-2026-106078

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Insufficient access control in the project management tool allows unauthorized retrieval of file assets. The endpoints 'WorkspaceFileAssetEndpoint.get' and 'WorkspaceAssetDownloadEndpoint.get' resolve...

CVE-2026-103956

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-103956 Missing authentication for critical function in Loom for AWS

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

EUVD-2026-91770

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

Missing Authentication in Brocade ASCGStreaming Service (CVE-2026-85421)

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

CVE-2026-103956: Missing Authentication for Critical Function

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CentOS Linux 6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-http-geoip / etc (CENTOS6:CLSA-2026:1784804810)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1784804810 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map'...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1787916225)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787916225 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1788337827)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1788337827 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side...

PT-2026-103270

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager versions prior to 20.9.10.1 Cisco Catalyst SD-WAN Manager versions prior to 20.12.8.2 Cisco Catalyst SD-WAN Manager versions prior to 20.15.6.1 Cisco Catalyst SD-WAN Manager versions prior to 20.18.4.1 Cisco...

WSO2 CVE-2026-5430 JWT Auth Bypass Detect

Detects CVE-2026-5430 in WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway: JWTUtil accepts tokens whose alg header is outside the supported RS256/384/512 set. Probes admin APIs with an alg:none X-JWT-Assertion. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WSO2...

DEBIAN-CVE-2026-98023

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

CVE-2026-98023

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

PT-2026-98420

CISA added two critical flaws to the KEV catalog yesterday, confirming active exploitation in the wild. Both are being actively targeted. Technical Breakdown: - CVE-2026-5430 CVSS 9.8: Path traversal in WSO2 API Control Plane. Allows unauthenticated remote attackers to read arbitrary files or...

Linux Distros Unpatched Vulnerability : CVE-2026-98023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overl...

PT-2026-98810

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/gud component where the driver fails to validate if GUD ROTATION 0 is present in the supported rotations bitmask. When the drm plane create rotation property...

Improving the Reliability of Anomaly Detection for Encrypted OPC UA Traffic over Private 5G

Open Platform Communications Unified Architecture OPC UA is increasingly deployed over private 5G networks in industrial environments, where end-to-end encryption prevents payload inspection by network-based intrusion detection systems IDSs. Although payload-agnostic statistical features extracte...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...