CVE-2026-72679

Elasticsearch is affected by CVE-2026-72679 due to a pattern-compiled intervals query that can recurse unboundedly if a deeply nested pattern is supplied. The root cause is that input length restrictions are not applied to user-supplied patterns, allowing an authenticated, read-only user on a sin...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-81)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and...

CVE-2026-19182 OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...

PT-2026-71765

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to...

CVE-2026-68445

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4gemobjectmmap rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotec...

CVE-2026-19656

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user including one holding only low-privilege, read-only permissions to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the conte...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

EUVD-2026-57398

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18171

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

CVE-2026-18171 Docker Sandboxes read-only runtime mount writable through its shared-export alias

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

EUVD-2026-57236

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

CVE-2026-18171

CVE-2026-18171 affects Docker Sandboxes (sbx) where the read-only intent of a runtime host mount is applied only to the in-guest bind; the virtio-fs host-edge grant is added to the sandbox policy-share allowlist with no access mode. The result is that the directory remains writable at the shared-...

DEBIAN-CVE-2026-68445

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4gemobjectmmap rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotec...

CVE-2026-68445 drm/vc4: Prevent shader BO mappings from becoming writable

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4gemobjectmmap rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotec...

PT-2026-70959

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4 gem object mmap rejects a writable mapping of a validated shader BO, but leaves VM MAYWRITE set. Userspace can map the BO read-only and then turn it writable with...

PT-2026-71098

Docker Sandboxes sbx applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged cod...

CVE-2026-73249 calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-73249

Summary: Calibre Content Server before 9.12.0 allows unauthorized annotation changes via POST /book-update-annotations/{library_id}/{book_id}/{fmt} due to omitting needs_db_write=True in src/calibre/srv/books.py. This prevents Router.dispatch() from invoking ctx.check_for_write_access() before up...