PT-2026-98763

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 multicast implementation where the ip6 mc source function modifies psl-sl addr and psl-sl count in-place during the addition or removal of source filters...

PT-2026-99089

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The External Data Source feature, which retrieves records from external systems, fails to properly verify user permissions before including record details in requests. An authenticated user with basic...

SUSE CVE-2026-73064

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers...

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

GHSA-JMG2-RCXH-W8Q3 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Log Source Management App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify...

CVE-2026-61782

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-73064

A flaw was found in Mbed TLS. An attacker who can cause an entropy source to fail can remove or inject bytes into the start of the Transport Layer Security TLS stream. This vulnerability specifically affects TLS 1.3 servers, potentially compromising the integrity of communication...

CVE-2026-81508

The ESF-IDF (Espressif Internet of Things Development Framework) versions 5.5.5 , 6.0.1 , and 6.1 are vulnerable to an out-of-bounds read in the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media(). The root cause is that the function reads a timestamp field from a received media buffer ...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782

The @rsdoctor/rspack-plugin (prior to version 1.5.16 ) contains an unauthenticated HTTP API that exposes sensitive build information. The default Rsdoctor report server binds to all network interfaces (0.0.0.0 ) and provides a POST /api/data/key endpoint with no authentication and wildcard CORS. ...

CVE-2026-85057

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

CVE-2026-94612

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

DEBIAN-CVE-2026-93803

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

CVE-2026-94612

The authentik identity provider is vulnerable to an authentication bypass via assertion confusion in SAML Sources prior to versions 2026.2.7, 2026.5.7, and 2026.8.2. The root cause is that the SAML Source verifies an assertion's signature and validity period but fails to ensure the assertion was ...

EUVD-2026-86276

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

CVE-2026-94612

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

CVE-2026-94612 authentik: Authentication bypass via assertion confusion in SAML sources

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...