CVE-2026-103504: Least Privilege Violation

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

CVE-2026-105267: Incorrect Permission Assignment for Critical Resource

The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...

Malicious Package

Overview tiny-viewport-unit-calc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in tiny-viewport-unit-calc (npm)

Source: amazon-inspector 34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e The package ships thunderboltRegistry.js, a module that imports Node's childprocess primitives and executes whoami plus repeated ping commands against external hostnames, with POST calls present in the same...

MAL-2026-17528 Malicious code in tiny-viewport-unit-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e The package ships thunderboltRegistry.js, a module that imports Node's childprocess primitives and executes whoami plus repeated ping commands agains...

Malicious code in tiny-viewport-unit-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e The package ships thunderboltRegistry.js, a module that imports Node's childprocess primitives and executes whoami plus repeated ping commands agains...

CVE-2026-55396

The Teledyne FLIR Aware2 software, specifically in versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) , is vulnerable to the cleartext transmission of UDP traffic from the operator control unit to the robot. Because this traffic lacks a cryptographic integrity check , adjacent unauthenticat...

SUSE CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

PT-2026-104015

Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description UDP traffic between the operator control unit and the robot is transmitted in cleartext without a cryptographic integrit...

CVE-2026-97864

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

EUVD-2026-87066

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864

A vulnerability exists in GibbonEdu Gibbon (versions up to 30.0.01 ) within the Unit Planner component. Specifically, the makeBlock function in the file modules/Planner/units_add_blockAjax.php fails to perform proper authentication when the gibbonUnitBlockID/mode argument is manipulated. This fla...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

DEBIAN-CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

UBUNTU-CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

EUVD-2026-86858

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

CVE-2026-97550

The Linux kernel contains a logic error in the xfs filesystem regarding per_binval computation. The vulnerability stems from performing unit conversions in the wrong direction: the second parameter of xfs_buf_inval_log_space is expected in bytes , while max_binval is measured in fsblocks . This r...