DEBIAN-CVE-2026-111555

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

CVE-2026-111555

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

CVE-2026-111555

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

CVE-2026-111555

A flaw exists in luksmeta due to improper boundary validation of metadata slots. An attacker capable of supplying or modifying a disk header can redirect wipe or load operations outside the intended metadata area. By providing a crafted header with valid checksums, an attacker can overwrite or ze...

CVE-2026-111555

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

EUVD-2026-102857

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

CVE-2026-111555 Luksmeta: missing slot-range validation permits out-of-gap device i/o

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

CVE-2026-19864

A flaw was found in Eclipse Jetty. The session authentication mechanism retains user credentials in session objects, which can cause plaintext passwords to be written to persistent storage when authenticated sessions are saved. An attacker with read access to the persistent session data store can...

CVE-2026-100826

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Storage: StorageManager component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securit...

CVE-2026-100798

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Cryptography misuse in Storage: Quota Manager component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-100773

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: IndexedDB component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-100759

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Storage: Quota Manager component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red H...

EUVD-2026-102497

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...

CVE-2026-111555: Improper Validation of Specified Index, Position, or Offset in Input

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

Linux Distros Unpatched Vulnerability : CVE-2026-19864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the...

CVE-2026-42270: Uncaught Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

PT-2026-115599

Name of the Vulnerable Software and Affected Versions luksmeta affected versions not specified Description Improper boundary validation of metadata slots allows an attacker who can supply or modify a disk header to redirect wipe or load operations outside the intended metadata area. By providing ...

CVE-2026-111650: Missing Authentication for Critical Function

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

PT-2026-115626

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The storage status-change REST service allows location records associated with DICOM instances to be transitioned to deletion-related states. Specifically,...

CVE-2026-111701: Missing Authentication for Critical Function

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/bucketId/path is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pat...