CVE-2026-86867

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

A flaw was found in OpenJDK. The XML cryptographic component does not properly utilize the base Uniform Resource Identifier URI when resolving external references during data retrieval. A remote attacker could exploit this flaw by providing crafted XML input to induce the application to fetch...

CVE-2026-82011

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...

CVE-2026-82011

Adobe Campaign Classic (ACC) is affected by an SQL Injection vulnerability (CWE-89) caused by the improper neutralization of special elements used in an SQL command. A low-privileged attacker can exploit this issue without user interaction to bypass security features and gain unauthorized read an...

EUVD-2026-84656

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...

CVE-2026-82011 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...

CVE-2026-82011 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...

SUSE CVE-2026-91142

A flaw was found in Cockpit. An authenticated local user with a large user identifier UID can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entri...

CVE-2026-82011: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...

CVE-2026-55179

Joplin Server (the self-hosted component of the open-source note-taking app Joplin) contains an authorization flaw in its GET /items/:id/content route (defined in packages/server/src/routes/index/items.ts). Prior to version 3.7.2 , the route loads item content using an attacker-supplied internal ...

CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

SUSE SLES15: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (SUSE-SU-2026:4002-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4002-1 advisory. Upgrade to upstream tag jdk-17.0.20.1+1 August 2026 CSPU. - CVE-2026-60589: unauthenticated attacker with network access via multip...

UBUNTU-CVE-2026-91142

A flaw was found in Cockpit. An integer overflow vulnerability in the dolastlog function, specifically in the offset calculation for lastlog entries on ILP32 Integer, Long, Pointer 32-bit builds, can be exploited. A low-privileged authenticated user with a specially provisioned large User ID UID...

PT-2026-95459

Name of the Vulnerable Software and Affected Versions Bransys ELD affected versions not specified Description The software is shipped with hardcoded MQTT credentials. This allows unauthorized read access to real-time data for every active device across a subset of carriers connected to the affect...

PT-2026-95458

Name of the Vulnerable Software and Affected Versions Bransys ELD affected versions not specified Description The software is shipped with hardcoded MQTT credentials. This allows unauthorized read access to real-time data for every active device across a subset of carriers connected to the affect...

CVE-2026-91142: Out-of-bounds Write

A flaw was found in Cockpit. An authenticated local user with a large user identifier UID can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entri...

Linux Distros Unpatched Vulnerability : CVE-2026-87275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-87281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable...

PT-2026-94064

Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.66.0 Description The software fails to verify JSON Web Token JWT signatures before establishing user identity. This allows an attacker to bypass role-based access control by presenting an unverified token containing a...