CVE-2026-111926

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

EUVD-2026-103293

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926

The Coder software versions 2.10.0 through 2.34.8 are vulnerable to an information disclosure flaw. An unauthenticated agent debug HTTP server listening on 127.0.0.1:2113 contains a /debug/manifest handler that returns the full agent manifest. This manifest includes sensitive template-provided en...

CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability arises from the fact that hcisock does not reject OCF values that exceed the security filtering range. Instead, it uses the 127 mask and 10-bit OCF value to search for commands. As a result, privileged sockets can submit reserved O...

OpenTelemetry - CNCF OpenTelemetry Python encryption issue vulnerability

OpenTelemetry – CNCF OpenTelemetry has a security vulnerability in versions 1.5.0 to 1.45.0 of the Python library. This vulnerability stems from improper certificate verification. When the OTELEXPORTEROTLPCERTIFICATE variable is an empty string, TLS verification is disabled, allowing...

ProjectSend processing logic error vulnerability

Versions of ProjectSend from 2.0.0 to 2.7.0 have a processing logic vulnerability. This vulnerability stems from a path validation flaw in OrphanFileScanner::isOrphan. Employees with the importorphans permission can treat tracked files as isolated files. An attacker can import or delete endpoints...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 6.6.15 to 6.7, 6.7.3 to 6.8, and 6.8 itself. These vulnerabilities stem from issues where, when the queue is removed from the host AP configuration and assigned to an intermediary device, the functions vfioapmdevResetQueue and...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains security vulnerabilities. These vulnerabilities stem from the fact that in the function cd321xupdatework, the variable typecpartnerdesc is not initialized to zero. Only the variables usbpd, accessory, and identity are initialized. As a result, fields such as...

CLSA-2026-1792022281 mariadb: Fix of 2 CVEs

Rebase onto the vendor's 5.5.68-1.0.1 sources - CVE-2021-46657: fix crash in getsortbytable on subquery with ORDER BY referencing an outer-query alias MDEV-25629 - CVE-2025-13699: take the vendor's fix, keep our regression test, fix the mysqlimport crash with the default charset - Take the...

Exploit for CVE-2026-99999

cve-2026-99999-audit !CVEhttps://img.shields.io/badge/CVE-...

Exploit for CVE-2026-64560

OPPO Find X10 Pro Max PMX110 / OP659FL1 · CVE-2026-64560 Res...

Exploit for CVE-2026-8933

CVE-2026-8933 — snap-confine mount-namespace race → local ro...

EUVD-2026-103193

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

CVE-2026-111926: Exposure of Sensitive Information to an Unauthorized Actor

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4691-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4691-1 advisory. - CVE-2026-86420: Denial of Service due to memory budget exhaustion bsc1279696. - CVE-2026-86421: Denial of...

PT-2026-116378

Name of the Vulnerable Software and Affected Versions Rank Math SEO PRO version 3.0.123 Description A supply-chain compromise occurred where a subset of packages distributed between October 15, 2026, and October 16, 2026, contained embedded malware. This issue has been actively exploited in the...