Linux Distros Unpatched Vulnerability : CVE-2026-14373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an...

Linux Distros Unpatched Vulnerability : CVE-2026-57216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:38995)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38995 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes:...

PT-2026-59274

Summary An unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an Authorization header. No authentication is required. The...

PT-2026-59499

Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the...

PT-2026-59357

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

Decidim - Verification documents can be downloaded through reusable links

Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed /rails/activestorage/disk/ URLs that can be fetched without any authenticated session. Anyone who obtains one of those URLs can retrieve the document until...

ROS-20260713-73-0024

The vulnerability of the FileLoader class in the CPython interpreter relates to the disclosure of information in the error-prone data area. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

PT-2026-60044

Impact AsyncListener.handle query or defer retained every truncated TC-bit incoming query in self. deferredaddr and armed a per-addr timer in self. timersaddr that flushed the reassembled query within 500 ms RFC 6762 §18.5. Neither the per-addr list nor the number of distinct addr keys was capped...

PT-2026-57812

Name of the Vulnerable Software and Affected Versions gawk versions 5.4.0 and earlier Description A Use After Free issue exists in the io.c file within the do getline redir function. This flaw can result in a program crash. Use After Free is a memory corruption flaw that occurs when an applicatio...

The vulnerability of the _nfs4_open_and_get_state() function in the fs/nfs/nfs4proc.c module, which is part of the NFS client support in Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the nfs4openandgetstate function in the fs/nfs/nfs4proc.c module, which is part of the NFS client support in Linux kernel, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the queueattrstore() function in the block/blk-sysfs.c module, which supports the block-level kernel in the Linux operating system, allows a attacker to cause a service failure.

The vulnerability of the queueattrstore function in the block/blk-sysfs.c module, which supports the block-level kernel in the Linux operating system, is related to the occurrence of mutual locking. Exploiting this vulnerability could allow a attacker to cause service failures...

MAL-2026-10228 Malicious code in chat-adapter-zoom (npm)

The chat-adapter-zoom package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Zoom...

BIT-NEXTCLOUD-2022-39210 Access to internal files of the Nextcloud Android app

Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitiv...

BIT-DJANGO-2026-48588 Potential exposure of private data via cached Set-Cookie response

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier,...

MAL-2026-10199 Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

CVE-2026-52747

A flaw was found in ModSecurity, an open-source web application firewall WAF. The multipart/form-data request body parser in libmodsecurity incorrectly handles embedded line breaks in non-file form-field values. This discrepancy between ModSecurity and backend applications, which preserve line...

EUVD-2026-43127

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2026-49394 Frappe: Auth. bypass via update_page

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the updatepage endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0...