CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878

GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 leaves initial setup functionality exposed after setup completion, enabling remote authenticated attackers to bypass authentication and gain administrative control; CVSS 4.0 scores this CRITICAL (9.2), with a fix available in version 3...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

EUVD-2026-61129

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878: Missing Authentication for Critical Function

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

PT-2026-77247

Name of the Vulnerable Software and Affected Versions GBIF Integrated Publishing Toolkit versions prior to 3.3.4 Description An authentication bypass exists because the initial setup functionality remains exposed after the setup process is completed. This allows remote authenticated attackers to...

PT-2026-77248

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879: Authentication Bypass Using an Alternate Path or Channel

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-72327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams...

CVE-2026-47683

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process...

CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

CVE-2026-47683: Allocation of Resources Without Limits or Throttling

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

CVE-2026-47698: Improper Control of Dynamically-Managed Code Resources

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099700 advisory. In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA...

CVE-2026-72050

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following devmkcalloc allocations for the BPID mapping arrays fails, the function...

UBUNTU-CVE-2026-72056

In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails createqueueswithsizebackoff creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX queues fails, the error...

CVE-2026-72327 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...