CVE-2026-28930

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...

CVE-2026-28930

CVE-2026-28930 affects macOS Tahoe; a permissions issue allowed an app to access protected user data. The RedHat/NCSC/EUVD/NVD/Nessus entries and related feeds confirm the root cause as a permissions restriction, with the resolution being the macOS Tahoe 26.5 security update that applies addition...

CVE-2026-28930

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Impact Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data//.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing...

The vulnerability of the Azure DevOps software development tool, related to information disclosure, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Azure DevOps software development tool is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260507-73-0001

Vulnerability in roundcubemail related to lack of validation of received requests. Exploitation of the vulnerability could allow a remote attacker to disclose protected information...

ROS-20260505-73-0079

A vulnerability in the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address and ipaddress.IPv6Network classes of the ipaddress module of the Python programming language interpreter CPython is related to incorrect IP address range validation. Exploitation of the vulnerability could...

ROS-20260505-73-0074

A vulnerability in the ngxstreamsslmodule module of the NGINX Plus and NGINX Open Source HTTP server is related to a flaw in the authorization procedure. Exploitation of the vulnerability may allow a remote intruder to bypass security restrictions and gain unauthorized access to protected...

The vulnerability of the mpi3mr_init_ioc() function in Linux operating systems allows a attacker to compromise the accessibility of protected information.

The vulnerability of the mpi3mrinitioc function in Linux operating systems is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

The vulnerability of the erofs_worker() function in Linux operating system kernels, which allows a hacker to compromise the accessibility of protected information

The vulnerability of the erofsworker function in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

The vulnerability of the `scsi_proc_hostdir_rm()` function in Linux operating systems allows attackers to compromise the accessibility of protected information.

The vulnerability of the scsiprochostdirrm function in Linux operating systems is related to a violation of the count of links to pages displayed in memory. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

The vulnerability of the kfree() function in Linux operating system kernels, which allows a attacker to compromise the accessibility of protected information

The vulnerability of the kfree function in Linux operating system kernels is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

ROS-20260429-73-0042

A vulnerability in the ngxstreamsslmodule module of the NGINX Plus and NGINX Open Source HTTP server is related to a flaw in the authorization procedure. Exploitation of the vulnerability may allow a remote intruder to bypass security restrictions and gain unauthorized access to protected...

The vulnerability of the application management tools and Flatpak environments relates to the tracking of UNIX-style symbolic links. This vulnerability allows a malicious actor to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the application management tools and Flatpak environments relates to the tracking of symbolic links in UNIX. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information and execute arbitrary code...

The vulnerability in the web interface for managing the Cisco Unity Connection integrated messaging system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web interface for managing the Cisco Unity Connection integrated messaging system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the rb_end_commit() function in the Linux operating system’s kernel allows a attacker to compromise the accessibility of protected information.

The vulnerability of the rbendcommit function in the Linux operating system’s kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

The vulnerability of the Jenkins automation server lies in the lack of protection for service data, allowing attackers to gain unauthorized access to the protected information.

The vulnerability of the Jenkins automation server lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the cupsd server daemon in the CUPS printing system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the cupsd server in the CUPS printing system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20260420-73-0025

Vulnerability in python-aiohttp related to lack of service data protection. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the rewriteRequestHeaders() function in the Fastify framework, a Node.js software platform, allows a malicious actor to gain unauthorized access and modify protected information.

The vulnerability of the rewriteRequestHeaders function in the Fastify framework, a Node.js software platform, is related to HTTP request processing flaws. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...