Incorrect Authorization

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Incorrect Authorization through improper handling of collection type casting...

Incorrect Authorization

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Incorrect Authorization through the execution of unintercepted operations...

Important: Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update

Multicluster Global Hub v1.8.2 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

[SECURITY] Fedora 43 Update: roundcubemail-1.6.19-1.fc43

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

[SECURITY] Fedora 44 Update: roundcubemail-1.7.4-1.fc44

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

PT-2026-94246

Name of the Vulnerable Software and Affected Versions rcourtman Pulse versions 6.0.4 and 6.1.0-rc.4 Description Improper input validation occurs in the Quick Security Setup Handler component when processing the Username argument within the fmt.Sprintf function at the '/api/security/quick-setup'...

CVE-2026-77614: Session Fixation

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mhdefaultorg.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does no...

CVE-2026-93147: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-90056: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fecptpinit is only called when fep-bufdescex is available. However, fecprobe unconditionally calls fecptpstop on the failedinit path, and fecdrvremove unconditionally calls fecptpstop...

Experimental Demonstration of Finite-Size General Security Via Discrete-Modulated CVQKD with Real Time Postprocessing

Continuous-variable quantum key distribution CVQKD is compatible with telecommunication infrastructure, but implementing composable security with experimentally practical resources has remained challenging, particularly for discrete-modulated DM protocols. We report the first experimental...

CVE-2026-78427: Reliance on Untrusted Inputs in a Security Decision

The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...

CVE-2026-93160: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmelecdhcomputesharedsecret uses the private key stored in the device. However, the public key is cached only after atmelecdhsetsecret...

CVE-2026-93037: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

PT-2026-94288

Name of the Vulnerable Software and Affected Versions BerqWP versions prior to 4.1.16 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to version 4.1.16 or later...

Trust, but Validate the Instrument: Auditing AI-Generated RTL Verification Plans on Authored Security-Regression Proxies

AI-generated RTL verification plans can satisfy a provider schema yet fail at the boundary to trusted execution. We present SecTB-RTL, an auditable framework covering 31 tasks and 124 authored hardware-security regressions. A deterministic non-AI baseline killed 36, 75, and 78 mutants at increasi...

CVE-2026-92523: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-90134: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmaplocalpage usage in compress Several compressed I/O paths discard the address returned by kmaplocalpage and later access or unmap the page using pageaddress. This is invalid for highmem pages, and local mappings must...

KLA91296 Multiple vulnerability in Microsoft Other

Multiple vulnerability was found in Microsoft Other. Malicious users can exploit this vulnerability to bypass security restrictions, obtain sensitive information. Original advisories CVE-2026-55946 Exploitation Related products Microsoft-Copilot-Studio CVE list CVE-2026-55946 unknown Solution...

PT-2026-94969

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF LSM component where security bpf prog free is called via bpf prog put rcu, which serves as the call rcu callback for non-sleepable programs. This sequence...

PT-2026-94579

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the AppArmor module where the unprivileged transition restriction on unconfined profiles is not correctly applied when a task is already confined by a stack. This flaw...