The vulnerability of the Unbound DNS server, related to deficiencies in the data source verification mechanism, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Unbound DNS server is related to deficiencies in the mechanism for verifying data sources. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

SUSE CVE-2026-74676

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74676

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74676

CVE-2026-74676 affects the Linux kernel virtual terminal (VT) subsystem. The KDSKBMETA ioctl, which modifies keyboard meta mode, lacked the !perm permission check enforced by all other keyboard setter ioctls in vt_k_ioctl() . This allowed a process to change the meta mode on a non-controlling con...

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

Linux Distros Unpatched Vulnerability : CVE-2026-74676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl...

CVE-2026-31936

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3...

EUVD-2026-64170

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3...

CVE-2026-31936 Combodo iTop: Unauthorized access to object information via search operation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3...

CVE-2026-31936

Combodo iTop , a web-based IT service management tool, is affected by an unauthorized access vulnerability in its search operation prior to version 3.2.3 . Authenticated users can access object information they should not have permission to view, resulting in high impact on confidentiality, integ...

CVE-2026-31936 Combodo iTop: Unauthorized access to object information via search operation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

CVE-2026-58211

A flaw was found in NATS Server, a high-performance messaging system. This vulnerability allows a client to bypass normal authentication and connection restrictions by registering as a "noauthuser" through a specific parser path. This occurs when the client's initial operation is not a standard...

CVE-2026-69502

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63994

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-55621

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-77776

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...

CVE-2026-70452

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees. Mitigation To mitigate this issue...

EUVD-2026-63905

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...