BIT-ELASTICSEARCH-2026-63144 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

BIT-ELASTICSEARCH-2026-63140 Reachable Assertion in Elasticsearch Leading to Denial of Service

Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...

Oracle APEX (CVE-2026-60156) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: General as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: General. Easily exploitable vulnerability allows unauthenticated attacker with network...

CVE-2026-65925

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925

CVE-2026-65925 describes a Server-Side Request Forgery (SSRF) in JFrog Artifactory when using the Cargo remote repository. A user with read access to the Cargo remote repository could cause Artifactory to request unintended URLs and return the response. The CVSS 3.1 vector is NETWORK, PRIVILEGES ...

EUVD-2026-49577

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-66018 JFrog Artifactory build environment properties exposure

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

EUVD-2026-49573

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

CVE-2026-66018

CVE-2026-66018 affects JFrog Artifactory: Build readers can access another repository's environment properties by selecting a readable repository parameter when retrieving environment properties for a protected build, exposing build environment secrets. Impact is confidentiality only (no integrit...

EUVD-2025-210515

Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...

PT-2026-65116

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...

Linux Distros Unpatched Vulnerability : CVE-2026-61081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Performance Schema. Supported versions that are affected are MySQL...

SUSE CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

UBUNTU-CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

CVE-2026-64395 ksmbd: require source read access for duplicate extents

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

CVE-2026-64395

Summary: CVE-2026-64395 in the Linux kernel ksmbd exposes information disclosure via FSCTL_DUPLICATE_EXTENTS_TO_FILE. The source file is passed directly to vfs_clone_file_range() / vfs_copy_file_range() without checking the SMB access mask, enabling a handle opened with attribute access to copy c...

EUVD-2026-49035

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

Linux Distros Unpatched Vulnerability : CVE-2026-16743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege dro...