Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 / 12.1 < Security 2026 Update 4 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, 12.0, or 12.1 and is missing the Security 2026 Update 4 Patch. It is, therefore, affected by multiple vulnerabilities: - A missing authentication vulnerability exists in Esri Portal for ArcGIS that allows a...

PT-2026-116007

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT DIVISION RECEIVER DELETE who own a receiver group whos...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

Linux block and network PV device frontends do not zero memory regions before sharing them with the backend CVE-2022-26365, CVE-2022-33740. Additionally, the granularity of the grant table does not allow sharing smaller than a 4K page, resulting in unrelated data residing in the same 4K page as...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cifs: Fixed an integer overflow issue while processing the closetimeo mount option. The user-provided closetimeo mount parameter, of type u32, is intended to have an upper limit. However, before this limit is validated, the value...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: llc: Do not use skbget before devqueuexmit. The syzbot exploit can cause hosts to crash, especially when using llc and devices that do not support IFFTXSKBSHARING. In this case, the e1000 driver calls ethskbpad, where the skb is...

Astra Linux – Vulnerability in Chromium

Before version 89.0.4389.114, using screen sharing in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Firefox

When sharing geolocation during an active WebRTC share, Firefox may reset the WebRTC sharing state in the user interface, resulting in a loss of control over the currently granted permissions. This vulnerability affects Firefox versions earlier than 85...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cifs: Fixed an integer overflow during the processing of the acregmax mount option. The user-provided mount parameter acregmax, of type u32, is intended to have an upper limit. However, before it is validated, the value is...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.114, using "After Free" in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page and user gestures...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

Linux block and network PV device frontends do not zero memory regions before sharing them with the backend CVE-2022-26365, CVE-2022-33740. Additionally, the granularity of the grant table does not allow sharing smaller than a 4K page, resulting in unrelated data residing in the same 4K page as...

CVE-2026-110772 Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members'...

EUVD-2026-101572

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members'...

CVE-2026-110772 Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members'...

CVE-2026-110772 Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members'...

CVE-2026-110623

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

CVE-2026-110623 Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

CVE-2026-110623 Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

EUVD-2026-101251

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

CVE-2026-110772: Missing Authorization

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypass account sharing permissions. Authenticated members with readonly or no share can submit arbitrary entryids to modify other members'...

Linux Distros Unpatched Vulnerability : CVE-2026-110772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypas...