469527 matches found
EUVD-2026-77695
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...
CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...
CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...
CLSA-2026-1789404783 TuxCare security update for dompurify (2 CVEs)
TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.8-tuxcare.4...
OESA-2026-3761 openjdk-21 security update
The OpenJDK runtime environment. Security Fixes: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer ASan, the program leaks memory in various locations, eventually leading to high memory usage and causi...
OESA-2026-3750 openjdk-17 security update
The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: RMI. Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9...
OESA-2026-3741 openjdk-1.8.0 security update
Security Fixes: Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.cCVE-2023-48161 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable...
CLSA-2026-1789403396 TuxCare security update for @angular (5 CVEs)
TuxCare rebuilt 16 @angular packages to address 5 CVEs. Fixed in 19.2.25-tuxcare.1...
CLSA-2026-1789400953 TuxCare security update for dompurify (4 CVEs)
TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.2.7-tuxcare.3...
CLSA-2026-1789400657 TuxCare security update for org.apache.httpcomponents (1 CVE)
TuxCare rebuilt 7 org.apache.httpcomponents packages to address 1 CVE. Fixed in 4.5-tuxcare.1...
CLSA-2026-1789400252 TuxCare security update for org.springframework.ldap:spring-ldap-core (1 CVE)
TuxCare rebuilt org.springframework.ldap:spring-ldap-core to address 1 CVE. Fixed in 2.3.3.RELEASE-tuxcare.1...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of entitlements in the ClientApp update process. An attacker can gain unauthorized access to update operations by possessing only the create entitlement, which is incorrectly checked f...
CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/accesscontrolpolicies...
CVE-2026-82920
Mattermost versions 11.9.x ≤ 11.9.0 , 11.8.x ≤ 11.8.4 , and 11.7.x ≤ 11.7.7 fail to enforce authorization boundaries on the ABAC policy update endpoint. A channel or team administrator can detach a system-assigned ABAC parent policy by sending a crafted PUT /api/v4/access_control_policies request...
CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/accesscontrolpolicies...
OPENSUSE-SU-2026:21843-1 Security update for cadvisor
This update for cadvisor fixes the following issues: Changes in cadvisor: update vendor.tar to fix: bsc1279044, CVE-2026-84445 bsc1279224, CVE-2026-84304 bsc1279320, CVE-2026-84303: cadvisor: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization...
OPENSUSE-SU-2026:21849-1 Security update for kimi-code
This update for kimi-code fixes the following issues: Changes in kimi-code: Update to version 0.42.0: Add an experimental Updates panel with paginated progress messages from the main agent and subagents, enabled with KIMICODEEXPERIMENTALNOTIFYUSER=1 Turn the subagent model pool, Remote Control an...
CVE-2026-77181
Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...