SUSE CVE-2026-68178

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

SUSE CVE-2026-68180

In the Linux kernel, the following vulnerability has been resolved: intelth: fix MSC output device reference leak intelthoutputopen looks up the output device with busfinddevicebydevt, which returns the device with a reference that must be dropped after use. commit 95fc36a234da "intelth: fix devi...

SUSE CVE-2026-68203

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

SUSE CVE-2026-68205

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

SUSE CVE-2026-68206

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

SUSE CVE-2026-68215

In the Linux kernel, the following vulnerability has been resolved: media: radio-si476x: Unregister v4l2device on probe failure si476xradioprobe registers radio-v4l2dev before allocating the V4L2 controls and before registering the video device. If any of those later steps fails, probe returns...

GHSA-RM43-82J9-R4MJ

creationtimestamp| type| source ---|---|--- 2026-08-13 15:33:17+00:00| seen| https://gist.github.com/alon710/d62f1422f9dac4c6a1fc5e9b8b380828...

CVE-2026-28155

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CVE-2026-28155 WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

CVE-2026-28155 WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

MINI-C6RM-V7GF-H58V

Bulletin has no description...

CVE-2025-62318 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

CVE-2026-73488

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

CVE-2026-73620 GitPython before 3.1.57 Arbitrary File Overwrite and Read

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

CVE-2026-73616 OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...

CVE-2026-73616 OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...

CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

MINI-C7JP-3964-P7V5

Bulletin has no description...

CVE-2026-73039: Authorization Bypass Through User-Controlled Key

streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...