CVE-2026-28930

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...

CVE-2026-28930

A permissions issue in macOS Tahoe 26.5 and earlier versions (specifically versions prior to 26.5) allows an application to potentially access protected user data due to insufficient restrictions. This vulnerability was addressed by implementing additional restrictions. The fix is available in ma...

CVE-2026-28930

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Impact Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data//.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing...

The vulnerability of the Azure DevOps software development tool, related to information disclosure, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Azure DevOps software development tool is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition (EE) involves authentication errors, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260507-73-0001

Vulnerability in roundcubemail related to lack of validation of received requests. Exploitation of the vulnerability could allow a remote attacker to disclose protected information...

The vulnerability of the “removable blocking” function in the RoundCube Webmail email client allows attackers to disclose protected information and circumvent existing security restrictions.

The vulnerability of the “deleted image blocking” function in the RoundCube Webmail client lies in the lack of validation during incoming requests. Exploiting this vulnerability allows an attacker to disclose protected information and circumvent existing security restrictions...

ROS-20260505-73-0074

A vulnerability in the ngxstreamsslmodule module of the NGINX Plus and NGINX Open Source HTTP server is related to a flaw in the authorization procedure. Exploitation of the vulnerability may allow a remote intruder to bypass security restrictions and gain unauthorized access to protected...

ROS-20260505-73-0079

A vulnerability in the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address and ipaddress.IPv6Network classes of the ipaddress module of the Python programming language interpreter CPython is related to incorrect IP address range validation. Exploitation of the vulnerability could...

The vulnerability of the Google Chrome browser’s Views component allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Google Chrome browser’s Views component relates to the possibility of memory usage after deallocation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the mpi3mr_init_ioc() function in Linux operating systems allows a attacker to compromise the accessibility of protected information.

The vulnerability of the mpi3mrinitioc function in Linux operating systems is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

The vulnerability of the erofs_worker() function in Linux operating system kernels, which allows a hacker to compromise the accessibility of protected information

The vulnerability of the erofsworker function in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

The vulnerability of the `scsi_proc_hostdir_rm()` function in Linux operating systems allows attackers to compromise the accessibility of protected information.

The vulnerability of the scsiprochostdirrm function in Linux operating systems is related to a violation of the count of links to pages displayed in memory. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

The vulnerability of the kfree() function in Linux operating system kernels, which allows a attacker to compromise the accessibility of protected information

The vulnerability of the kfree function in Linux operating system kernels is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

ROS-20260429-73-0042

A vulnerability in the ngxstreamsslmodule module of the NGINX Plus and NGINX Open Source HTTP server is related to a flaw in the authorization procedure. Exploitation of the vulnerability may allow a remote intruder to bypass security restrictions and gain unauthorized access to protected...

The vulnerability of the application management tools and Flatpak environments relates to the tracking of UNIX-style symbolic links. This allows a malicious actor to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the application management tools and Flatpak environments relates to the tracking of symbolic links in UNIX. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information and execute arbitrary code...

The vulnerability in the web interface for managing the Cisco Unity Connection integrated messaging system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web interface for managing the Cisco Unity Connection integrated messaging system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the rb_end_commit() function in the Linux operating system’s kernel allows a attacker to compromise the accessibility of protected information.

The vulnerability of the rbendcommit function in the Linux operating system’s kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the use of files and directories accessible from external parties, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the FortiSandbox threat detection and mitigation system lies in the use of files and directories accessible from external parties. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...