ROS-20260707-73-0035

The vulnerability in dovecot is related to the lack of protection for service data. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

ROS-20260707-73-0027

The vulnerability in Apache Kafka is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260707-73-0006

The vulnerability in zabbix-lts is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260707-73-0024

The vulnerability of the system’s application programming interface for aggregating and storing Loki logs is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protecte...

CVE-2026-53913 Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely 'Failing Open' vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess, which performs three checks ...

Access control issue in AlekSIS-Core

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

The vulnerability of the GitHub authentication provider for Kubernetes Rancher’s cluster management software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the GitHub authentication provider for Kubernetes Rancher software management systems is related to flaws in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20260706-73-0023

The vulnerability of the timeofday function in the PostgreSQL database management system is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the FLS module in the OpenSearch software package allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the FLS module in the OpenSearch software package is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the ColdFusion software platform arises from an incorrect limitation on the path to the restricted access catalog. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the drm_gem_change_handle_ioctl() function in the Direct Rendering Manager (DRM) subsystem of Linux kernels allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the changehandle function in the Direct Rendering Manager DRM subsystem of Linux kernels relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the Cisco Identity Services Engine (ISE) policy management platform and the Cisco ISE Passive Identity Connector (ISE-PIC) virtual authentication data collection device is related to authentication procedures that allow unauthorized access by attackers to protected information.

The vulnerability of the Cisco Identity Services Engine ISE policy management platform and the Cisco ISE Passive Identity Connector ISE-PIC virtual authentication data collection device are related to deficiencies in the authentication process. Exploiting this vulnerability could allow a maliciou...

The vulnerability of the DLS component in the OpenSearch software package allows a intruder to gain unauthorized access to protected information.

The vulnerability of the DLS component in the OpenSearch software package is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Improper Authorization

Craft CMS is vulnerable to Improper Authorization. The vulnerability is due to insufficient permission checks when moving entries between sections, where only view permission is validated for the destination section instead of save permission, allowing low-privileged users to move entries into...

New Avalon Malware Framework Packs CrownX Ransomware Capabilities

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon combines credential collection, lateral movement, remote access,...

CVE-2026-11900 Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

CVE-2026-11900

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the adinserter shortcode. This is due to the replaceaitags function processing a reusable-block-N tag pattern that...

The vulnerability of the `move_normal_pmd()` and `move_normal_pud()` functions in the `mm/mremap.c` module of the Linux kernel’s memory management subsystem allows an attacker to compromise the accessibility of protected information.

The vulnerability of the movenormalpmd and movenormalpud functions in the mm/mremap.c module of the Linux kernel’s memory management subsystem is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information...

The vulnerability in the web interface for managing micro-program software on NetComm NF20MESH allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the web interface for managing micro-program software on NetComm NF20MESH routers is related to the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-8926: Insufficiently Protected Credentials

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...