MINI-7R58-RWVH-P2CP

Bulletin has no description...

MINI-RCMQ-29W6-82X2

Bulletin has no description...

MINI-R582-C4R4-429C

Bulletin has no description...

MINI-H6XJ-XJVV-5FQ2

Bulletin has no description...

MINI-FV5H-2QXM-2456

Bulletin has no description...

MINI-QX66-76Q7-PXX2

Bulletin has no description...

MINI-95MX-7F8G-655W

Bulletin has no description...

MINI-G89V-83W3-X47Q

Bulletin has no description...

MINI-9293-3M3G-P4QQ

Bulletin has no description...

MINI-W26G-Q3C3-G98H

Bulletin has no description...

MINI-84R3-M5F7-WV3J

Bulletin has no description...

MINI-C7JW-8J7X-M5P6

Bulletin has no description...

MINI-GMHG-CGX7-VJWJ

Bulletin has no description...

MINI-VX7C-MXF9-6MFM

Bulletin has no description...

CLSA-2026-1790542520 TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.1...

CLSA-2026-1790542220 TuxCare security update for undici (12 CVEs)

TuxCare rebuilt undici to address 12 CVEs. Fixed in 6.19.7-tuxcare.1...

CVE-2026-101090 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboardhost setting is empty, /api/v1/oauth2/provider cmd/dashboard/controller/oauth2.go reflects the attacker-supplied HTTP Host header into the redirecturi sent to the identity...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101088 Nezha before 2.3.1 Denial of Service via Concurrent Server Delete

Nezha is a server and website monitoring tool. In versions = 2.2.11 and 2.3.1, the service sentinel worker service/singleton/servicesentinel.go contains an incomplete fix for a previously reported nil dereference denial of service GHSA-qjpp-gffx-2wm9. The 2026-07-21 fix re-validated the service...

CVE-2026-101087 Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because...

CVE-2026-101086 Nezha Dashboard before 2.3.5 Task Type Validation Bypass

Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to...

CVE-2026-101085 Nezha before 2.3.8 Denial of Service via Alert Rule

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint t...

CVE-2026-101084 obot before v0.21.1 Authorization Bypass via /mcp-connect

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through...

CVE-2026-101064 Obot before v0.23.0 Server-Side Request Forgery via MCP

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and clo...

CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CLSA-2026-1790542136 TuxCare security update for node-forge (1 CVE)

TuxCare rebuilt node-forge to address 1 CVE. Fixed in 1.3.3-tuxcare.1...

CLSA-2026-1790541942 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.5-tuxcare.1...

CLSA-2026-1790541935 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.17.1-tuxcare.1...

CLSA-2026-1790541933 TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.15.3-tuxcare.1...

CLSA-2026-1790541916 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.18.3-tuxcare.1...

CLSA-2026-1790541906 TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 4.11.9-tuxcare.1...

CLSA-2026-1790541900 TuxCare security update for postcss (1 CVE)

TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.17-tuxcare.1...

CLSA-2026-1790541875 TuxCare security update for stream-json (1 CVE)

TuxCare rebuilt stream-json to address 1 CVE. Fixed in 1.9.1-tuxcare.1...

CLSA-2026-1790541837 TuxCare security update for json-bigint (1 CVE)

TuxCare rebuilt json-bigint to address 1 CVE. Fixed in 0.3.1-tuxcare.1...

CLSA-2026-1790541831 TuxCare security update for browserslist (1 CVE)

TuxCare rebuilt browserslist to address 1 CVE. Fixed in 3.2.8-tuxcare.1...

DEBIAN-CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

ECHO-4E3E-C616-EEEC

Bulletin has no description...

ECHO-5677-35D2-FF1E

Bulletin has no description...

ECHO-788A-3A69-C59A

Bulletin has no description...

ECHO-0171-CABB-8F95

Bulletin has no description...

CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101047 Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests enterprise tier only with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet...

CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101049 Heym before 0.0.53 Slack Webhook Signature Verification Bypass

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials...

CVE-2026-101042 Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity

Parse Server is an open-source backend server. In versions = 9.0.0 = 8.0.2 8.6.91, the code-based authentication adapters GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo verify the client's authorization code with the external provider on signup and on...