EUVD-2026-48612

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-16798

The vulnerability CVE-2026-16798 affects Devolutions PowerShell Universal (automation jobs API) up to version 2026.2.2. The underlying issue is that job read responses fail to strip a user’s stored OAuth refresh token, allowing an authenticated user with scoped job or script read permission to ac...

CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

...

ImageMagick: Policy Bypass in script operation due to missing checks

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy...

GHSA-V3J6-27VC-7PW2 ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response...

ImageMagick: Policy Bypass in concatenate operation due to missing checks

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy...

EUVD-2026-41112

ImageMagick: Policy Bypass in concatenate operation due to missing checks...

EUVD-2026-41123

ImageMagick: Infinite Loop in connected-components when providing invalid arguments...

ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided...

EUVD-2026-41122

ImageMagick: Stack Overflow in MVG decoder due to missing depth check...

EUVD-2026-40456

electron-updater: Uncontrolled search path elements within AppImage built by app-builder-lib...

MINI-49GG-5X9C-5GJ4

Bulletin has no description...

MINI-G8J2-PWC6-CHQ8

Bulletin has no description...

MINI-69QV-V7JP-JJ8C

Bulletin has no description...

MINI-XH2H-RWMC-JF58

Bulletin has no description...

CVE-2026-66144

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

DEBIAN-CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...