CVE-2026-47721

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or...

CVE-2026-47721 FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or...

CVE-2026-47721 FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or...

CVE-2026-47721

FUXA versions prior to 1.3.2 fail to enforce admin permissions on POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js, allowing authenticated non-admin operators to schedule actions invoking onSetValue or onRunScript, enabling PLC setpoint changes and server-side script...

CVE-2026-72181

A flaw was found in the Linux kernel's scheduler component, specifically when handling CPU masks on MIPS architecture with CONFIGCPUMASKOFFSTACK enabled. An incorrect size calculation during the copyfromuser operation could lead to memory corruption. This vulnerability allows a local attacker to...

CVE-2026-75837

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with accessadminsuper=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities...

CVE-2026-75837 Grav before 2.0.14 Privilege Escalation via Group Access Field

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with accessadminsuper=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities...

BIT-AIRFLOW-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...

BIT-AIRFLOW-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

Linux Distros Unpatched Vulnerability : CVE-2026-72036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked multiqdequeue takes a packet from a band's child with a direct -dequeue call...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101992)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101992 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RTPUSHIPI be default off for non PREEMPTRT RT migration is done aggressively. When...

CVE-2026-72035

A flaw was found in the Linux kernel's taprio Time-Aware Priority Shaper scheduler. When the taprio software path processes network packets from a non-work-conserving child queue discipline qdisc, it can incorrectly handle the packet buffer, leading to a null pointer dereference. This issue can...

CVE-2026-71193

A flaw was found in OpenStack Designate. When the AttributeFilter scheduler is enabled with multiple DNS pools, an authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool. The database uniqueness constraint on zone names is pool-scoped, and the...

CVE-2026-72430

A flaw was found in the Linux kernel's network scheduling component. An unprivileged user with administrative privileges in a network environment can trigger a resource leak. This occurs when specific error handling paths fail to properly release network connection labels. Repeated exploitation o...

BIT-AIRFLOW-2026-58076 Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099747)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099747 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/rt: Skip currently executing CPU in rtonextcpu CPU0 becomes overloaded when hosting a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100727)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100727 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advancesched on schedule switch In advancesched, when...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100532)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100532 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RTPUSHIPI be default off for non PREEMPTRT RT migration is done aggressively. When...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100733)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100733 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ipvseditservice while unbinding the old scheduler...