PT-2026-84989

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

Your DNS Is Hiding in HTTPS — This Is Why It Matters

Discover why unmanaged DNS over HTTPS DoH creates security visibility gaps and how a controlled DoH strategy restores visibility without compromising privacy...

NetAlertX v26.9.0

NetAlertX - Network Visibility & Asset Intelligence Framework !mainmain 📷 Click for more screenshots !Main screenmain| !devicedetails 1devicedetails| !Screen networknetwork ---|---|--- !presencepresence| !maintenancemaintenance| !settingssettings !synchubsynchub| !report1report1|...

CVE-2026-75847 Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version...

CVE-2026-82272

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

EUVD-2026-67803

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272

Immich versions up to 3.1.0 contain a visibility enforcement flaw: when an asset is locked via the single-asset endpoint , the lock is not correctly applied to shared albums and shared links , allowing a low-privileged attacker to read the asset and its metadata without bypassing any other protec...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272 Immich Locked Assets Remain Readable Through Albums and Shared Links

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-82272

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

Key Reasons Why Identity Fabric Matters in 2026

An Identity Fabric knits fragmented identity systems into a coherent layer that observes how identities behave across applications, APIs, and infrastructure. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on...

CVE-2026-80596

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes via .devgroups in the usbdriver structure, the attributes started appearing ...

PT-2026-82896

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ims-pcu driver where sysfs attributes are incorrectly exposed on all interfaces bound to the driver, including the secondary data interface. This occurs because th...

PT-2026-83295

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

immich -- locked assets remain accessible through shared albums and links

VulnCheck reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. In 3.2.2 the single-asset endpoint still lacks the album removal that the bulk...

CVE-2026-81684

openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 contain an information disclosure flaw in its desktop GUI. The steganography password is passed to a CLI child process via the --stego-password command-line argument (on both encrypt and decrypt paths) rather than through an environme...

CISA: Logging Reference Architecture

The Cybersecurity and Infrastructure Security Agency CISA developed the Logging Reference Architecture LRA in alignment with Office of Management and Budget Memorandum M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, which w...

mcpsnoop v0.19.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

Linux Distros Unpatched Vulnerability : CVE-2026-7485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in frozen BI aggregations in Checkmk 2.5.0p2, 2.4.0p29, 2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted ho...

CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...