CVE-2026-82431

The Apache Storm cluster is vulnerable to an authorization bypass in the SimpleACLAuthorizer component. The vulnerability occurs because the authorizer returns early when the nimbus.users list is empty, failing to evaluate the nimbus.groups list. Consequently, operators who configure access restr...

CVE-2026-90939 novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-90939

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint, which lacks proper permission annotations . Authenticated attackers can retrieve password hashes and personal data (email addresses, phone numbers) for users within their data scope, enabling...

EUVD-2026-77483

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-90939 novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-90939 novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

EUVD-2026-77481

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

CVE-2026-73178

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests,...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell direct-impact fixture Deliberately vulnerable, non-...

CVE-2026-77147

Apache Syncope is vulnerable to an Improper Control of Generation of Code (Code Injection) vulnerability. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation , effectively ...

Astra Linux – Vulnerability in Chromium

The incorrect security UI in PictureInPicture in Google Chrome prior to version 146.0.7680.71 allowed a remote attacker to perform UI spoofing through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Mariadb 10.3

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server up to 2021-03-03; and the wsrep patch up to 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUP...

Astra Linux – Vulnerability in Linux 5.10, Linux

A NULL pointer dereference flaw was discovered in the az6027 driver, located in the file drivers/media/usb/dev-usb/az6027.c within the Linux Kernel. The message from the user space is not properly checked before being transferred to the device. This flaw could allow a local user to crash the syst...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL. By using an UPDATE...RETURNING command on a specially crafted table, an authenticated database user could read arbitrary bytes of server memory. The most significant threat of this vulnerability is data confidentiality...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor patches that incorrectly attempt to free a pointer that was not previously allocated using kmalloc. At the same time, allocated memory is also leaked. This bug can be triggered by an unprivileged local user, and it can result in corruption of slab...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free read flaw was discovered in the sockgetsockopt function in net/core/sock.c, due to race conditions involving SOPEERCRED and SOPEERGROUPS functions when used with listen and connect in the Linux kernel. In this flaw, an attacker with user privileges could potentially crash the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi – fixed an issue to avoid directly dereferencing the user pointer. In vidiconnectionioctl, vidi-ediduser pointer is directly dereferenced in the kernel. This allows arbitrary kernel memory access from the user...