CGA-X534-W5M3-5HXM

Bulletin has no description...

CVE-2026-71543 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...

CVE-2026-52742 GoCD is vulnerable to historical server configuration API authorization bypass

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...

CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs

GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...

CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...

CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-55060 GoCD is vulnerable to authorization bypass via support process list API

GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line...

CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

MINI-3QWJ-FG6V-3G63

Bulletin has no description...

MINI-PG45-9GX4-4CGM

Bulletin has no description...

MINI-4G3W-27MQ-6532

Bulletin has no description...

MINI-R68J-XFQ8-2QVR

Bulletin has no description...

MINI-9C95-67J3-9F27

Bulletin has no description...

MINI-7QH9-2QP3-J93M

Bulletin has no description...

MINI-3M3P-XQX3-M69P

Bulletin has no description...

MINI-4GQ7-RVXG-J82V

Bulletin has no description...

MINI-M5R3-2RHF-GRGX

Bulletin has no description...

MINI-5WRX-F57J-GCGC

Bulletin has no description...

MINI-VV9W-5C66-7F95

Bulletin has no description...

MINI-7WFJ-CJ2C-HMMQ

Bulletin has no description...

MINI-H4X3-GWFX-PWQ5

Bulletin has no description...

MINI-VGQM-G79Q-72VG

Bulletin has no description...

MINI-JJXJ-XC6Q-W2W9

Bulletin has no description...

CVE-2026-68919 GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages

GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline...

MINI-545P-89JC-MFFC

Bulletin has no description...

MINI-XFR3-97PH-G4G3

Bulletin has no description...

MINI-F8XX-4QCJ-G4Q7

Bulletin has no description...

MINI-PG7P-MW4V-QG8F

Bulletin has no description...

CLSA-2026-1790002371 TuxCare security update for org.springframework.data (1 CVE)

TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 4.1.8-tuxcare.1...

CLSA-2026-1790002143 TuxCare security update for org.springframework.data (2 CVEs)

TuxCare rebuilt 3 org.springframework.data packages to address 2 CVEs. Fixed in 4.4.13-tuxcare.3...

CLSA-2026-1790002044 TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 4.1.8-tuxcare.1...

CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CLSA-2026-1788161320 TuxCare security update for pip (4 CVEs)

TuxCare rebuilt pip to address 4 CVEs. Fixed in 9.0.0.post2+tuxcare...

CGA-2P6Q-2944-866H

Bulletin has no description...

CGA-RVH9-RWJR-MCJM

Bulletin has no description...

CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-75158 Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow's /assets/events API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID,...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CGA-XG47-7GFX-W79F

Bulletin has no description...

CGA-7P8M-4C85-W3RR

Bulletin has no description...

CVE-2026-52743 GoCD before 26.1.0 is vulnerable to authorization bypass via job status API

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the us...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55567 BleachBit: Exploit File Delete to Escalate Privilege

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect...

CVE-2026-61629 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

DEBIAN-CVE-2026-88807

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients...

DEBIAN-CVE-2026-88806

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the keysymmap...

AZL-103388 CVE-2026-88806 affecting package libX11 1.8.7-1

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the keysymmap...

AZL-103391 CVE-2026-88807 affecting package libXrender 0.9.11-1

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients...

CVE-2026-94184 Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...