CVE-2026-42017

Technical details (affected products/versions, root cause, exploitability) are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2026-10600 Denial of service via unbounded document content extraction in Mattermost Server

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server v...

CVE-2026-10600

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server v...

CVE-2026-64424

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task...

UBUNTU-CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

EUVD-2026-48949

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

Linux Distros Unpatched Vulnerability : CVE-2026-64281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on...

Information Exposure

Overview @budibase/worker is a Budibase background service Affected versions of this package are vulnerable to Information Exposure in the login lockout process. An attacker can determine whether an email address is registered by sending multiple login attempts and observing differences in the...

Information Exposure

Overview @budibase/worker is a Budibase background service Affected versions of this package are vulnerable to Information Exposure via the tenantUserLookup function. An attacker can obtain sensitive user and tenant information, including email addresses, user IDs, tenant IDs, SSO identifiers, an...

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

Missing Authorization

Overview @budibase/worker is a Budibase background service Affected versions of this package are vulnerable to Missing Authorization in the GET /api/global/groups endpoint, which lacks proper role-based access control. An attacker can access sensitive group and role mapping information by sending...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

GHSA-4R2P-27MH-5M22 Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

PT-2026-67610

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC ENDPOINTS list with a TODO comment acknowledging it...

PT-2026-67585

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

PYSEC-2026-3542 vLLM has Remote DoS via Invalid Recovered Token Reinjection

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Service Worker mechanism in Google Chrome before version 148.0.7778.179 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...