CVE-2026-28930

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data...

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Impact Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /next/data//.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing...

The vulnerability of the Azure DevOps software development tool, related to information disclosure, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Azure DevOps software development tool is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260507-73-0001

Vulnerability in roundcubemail related to lack of validation of received requests. Exploitation of the vulnerability could allow a remote attacker to disclose protected information...

ROS-20260505-73-0079

A vulnerability in the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address and ipaddress.IPv6Network classes of the ipaddress module of the Python programming language interpreter CPython is related to incorrect IP address range validation. Exploitation of the vulnerability could...

ROS-20260505-73-0074

A vulnerability in the ngxstreamsslmodule module of the NGINX Plus and NGINX Open Source HTTP server is related to a flaw in the authorization procedure. Exploitation of the vulnerability may allow a remote intruder to bypass security restrictions and gain unauthorized access to protected...

The vulnerability of the kfree() function in Linux operating system kernels, which allows a attacker to compromise the accessibility of protected information

The vulnerability of the kfree function in Linux operating system kernels is related to the lack of memory release after the effective lifespan of the function has ended. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

The vulnerability of the `scsi_proc_hostdir_rm()` function in Linux operating systems allows attackers to compromise the accessibility of protected information.

The vulnerability of the scsiprochostdirrm function in Linux operating systems is related to a violation of the count of links to pages displayed in memory. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

ROS-20260429-73-0042

A vulnerability in the ngxstreamsslmodule module of the NGINX Plus and NGINX Open Source HTTP server is related to a flaw in the authorization procedure. Exploitation of the vulnerability may allow a remote intruder to bypass security restrictions and gain unauthorized access to protected...

The vulnerability of the application management tools and Flatpak environments relates to the tracking of UNIX-style symbolic links. This vulnerability allows a malicious actor to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the application management tools and Flatpak environments relates to the tracking of symbolic links in UNIX. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information and execute arbitrary code...

The vulnerability of the Jenkins automation server lies in the lack of protection for service data, allowing attackers to gain unauthorized access to the protected information.

The vulnerability of the Jenkins automation server lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the cupsd server daemon in the CUPS printing system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the cupsd server printing service in CUPS is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260420-73-0025

Vulnerability in python-aiohttp related to lack of service data protection. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the rewriteRequestHeaders() function in the Fastify framework, a Node.js software platform, allows a malicious actor to gain unauthorized access and modify protected information.

The vulnerability of the rewriteRequestHeaders function in the Fastify framework, a Node.js software platform, is related to HTTP request processing flaws. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...

ROS-20260414-73-0061

A vulnerability in the f2fsdecompresscluster function of the fs/f2fs/compress.c module of the F2FS file system of the Linux kernel is related to insufficient resource locking. Exploitation of the vulnerability may allow an intruder to affect the integrity and availability of protected information...

The vulnerabilities of the `png_write_image_16bit()` and `png_write_image_8bit()` functions in the library for working with PNG bitmap graphics allow attackers to gain unauthorized access to protected information.

The vulnerability of the pngwriteimage16bit and pngwriteimage8bit functions in the PNG bitmap graphics handling library is related to reading data beyond the allowed buffer limits. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

ROS-20260408-73-0026

A vulnerability in the drivers/soc/qcom/mdtloader.c component of the Linux kernel is related to buffer copying without input data validation. Exploitation of the vulnerability allows an intruder to gain unauthorized access to protected information...

The vulnerability of RabbitMQ message brokers, related to the disclosure of information through registration files, allows attackers to gain unauthorized access to protected information.

The vulnerability of the RabbitMQ messaging broker is related to the exposure of information through registration files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the RDP client FreeRDP, related to reading beyond the buffer in memory, allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the RDP client FreeRDP relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and accessibility of protected information...

ROS-20260401-73-0001

A vulnerability in the HTML Style Checker module of RoundCube Webmail is related to incorrect encoding or escaping of output data. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...