FreeBSD : Gitlab -- Vulnerabilities (3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3 advisory. Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site...

Linux Distros Unpatched Vulnerability : CVE-2026-74371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes...

CVE-2026-67919

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

vcheck v1.6.3

vcheck Audit a remote Linux host over SSH for the Copy Fail and Dirty Frag kernel-module vulnerabilities and, optionally, apply mitigations: CVE| Name| Affected modules ---|---|--- CVE-2026-31431| Copy Fail| algifaead CVE-2026-43284| Dirty Frag IPsec| esp4, esp6, ipcomp4, ipcomp6, xfrmuser...

CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

UBUNTU-CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

FreePBX: From Unauthenticated SQL Injection to Root Shell...

GHSA-3P64-6GVH-82V5 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary When MLflow is deployed with the built-in basic-auth plugin --app-name basic-auth, any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map ...

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary When MLflow is deployed with the built-in basic-auth plugin --app-name basic-auth, any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map ...

GHSA-7GWP-5PFP-969J MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...

GHSA-8G4W-4FFG-8VGX 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...

CVE-2026-11817

CVE-2026-11817 is a CVSS 5.3 medium-severity issue in Grafana multi-org stacks: an Org Admin can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: to view dashboard/folder UIDs and per-user permission mappings from other organizations. Dashboard contents, secrets, and...

CVE-2026-11817 CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-11817 CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-75479

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

CVE-2026-75480

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to...

CVE-2026-64657

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...