🚨 CVE-2026-91865
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
🎖@cveNotify
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
🎖@cveNotify
🚨 CVE-2026-91866
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
🎖@cveNotify
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
🎖@cveNotify
🚨 CVE-2026-91867
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
🎖@cveNotify
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).
Users are recommended to upgrade to version 3.2.4, which fixes this issue.
🎖@cveNotify
🚨 CVE-2025-71419
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
🎖@cveNotify
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
🎖@cveNotify
GitHub
Release v1.1.8 · uvdesk/community-skeleton
Release Notes v1.1.8
💖 Features
Added rating on ticket view provided by customer based on support provided.
Updated UI - Added plus icon for ticket create, agent create etc.
Updates for search by...
💖 Features
Added rating on ticket view provided by customer based on support provided.
Updated UI - Added plus icon for ticket create, agent create etc.
Updates for search by...
🚨 CVE-2025-71420
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
🎖@cveNotify
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
🎖@cveNotify
GitHub
Release v1.1.8 · uvdesk/community-skeleton
Release Notes v1.1.8
💖 Features
Added rating on ticket view provided by customer based on support provided.
Updated UI - Added plus icon for ticket create, agent create etc.
Updates for search by...
💖 Features
Added rating on ticket view provided by customer based on support provided.
Updated UI - Added plus icon for ticket create, agent create etc.
Updates for search by...
🚨 CVE-2025-71421
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
🎖@cveNotify
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
🎖@cveNotify
GitHub
Release v1.1.8 · uvdesk/community-skeleton
Release Notes v1.1.8
💖 Features
Added rating on ticket view provided by customer based on support provided.
Updated UI - Added plus icon for ticket create, agent create etc.
Updates for search by...
💖 Features
Added rating on ticket view provided by customer based on support provided.
Updated UI - Added plus icon for ticket create, agent create etc.
Updates for search by...
🚨 CVE-2026-85220
A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot.
The vulnerability is accessible when the Redis service is enabled only.
The Canary is NOT affected if the Redis service is disabled.
Thinkst has addressed this issue on all supported platforms.
New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries.
Workarounds are available for customers unable to update at this time.
🎖@cveNotify
A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot.
The vulnerability is accessible when the Redis service is enabled only.
The Canary is NOT affected if the Redis service is disabled.
Thinkst has addressed this issue on all supported platforms.
New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries.
Workarounds are available for customers unable to update at this time.
🎖@cveNotify
🚨 CVE-2026-88806
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
🎖@cveNotify
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
🎖@cveNotify
GitLab
xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806) (!309) · Merge requests · xorg / lib / libX11 · GitLab
A malicious server could send a XkbGetMap reply with firstKeyAct + nKeyActs exceeding max_keycode=+ 1. This would cause an OOB write into info->map->key_sym_map[rep->firstKeyAct + i]. This...
🚨 CVE-2026-88807
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
🎖@cveNotify
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
🎖@cveNotify
GitLab
Check numSubpixel against numScreens to avoid OOB writes (CVE-2026-88807) (!19) · Merge requests · xorg / lib / libXrender · GitLab
A malicious server could reply to XRenderQueryFormat with a numSubpixels count greater than the number of screens, causing an OOB write into screen->subpixel which was allocated using numScreens....
🚨 CVE-2026-94382
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
🎖@cveNotify
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
🎖@cveNotify
GitHub
GitHub - henrygd/beszel: Lightweight server monitoring with historical data, docker stats, and alerts.
Lightweight server monitoring with historical data, docker stats, and alerts. - henrygd/beszel
🚨 CVE-2026-94387
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.
🎖@cveNotify
Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.
🎖@cveNotify
GitHub
GitHub - aureuserp/aureuserp: Free and Open Source ERP platform
Free and Open Source ERP platform. Contribute to aureuserp/aureuserp development by creating an account on GitHub.
🚨 CVE-2026-94393
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.
As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.
The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.
The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.
Version affected: <2.5.47
🎖@cveNotify
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.
As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.
The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.
The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.
Version affected: <2.5.47
🎖@cveNotify
GitHub
fix: [security] Refuse to adopt an event report that belongs to anoth… · MISP/MISP@43665b9
…er event
- a nested event report was resolved globally by UUID and saved under the outer event, so an event editor who knew a report UUID could reparent, read and overwrite a private report from ...
- a nested event report was resolved globally by UUID and saved under the outer event, so an event editor who knew a report UUID could reparent, read and overwrite a private report from ...
🚨 CVE-2026-94394
When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.
Because of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.
The vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.
The main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.
🎖@cveNotify
When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user.
Because of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.
The vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data.
The main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.
🎖@cveNotify
GitHub
fix: [security] Extended event granular restrictions ignored · MISP/MISP@f36634e
- only the event restrictions were checked
- as reported by Jeroen Pinoy
- as reported by Jeroen Pinoy
🚨 CVE-2026-94401
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.
If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.
The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.
Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.
Version affected: <2.5.47
🎖@cveNotify
MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead.
If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network.
The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services.
Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed.
Version affected: <2.5.47
🎖@cveNotify
GitHub
fix: [security] Refuse a MISP export upload whose content is a path o… · MISP/MISP@d5f247b
…r URL
- addMISPExportFile() passed the uploaded file's content to Xml::build() with readFile left at its default, so an .xml upload containing `/tmp/x.xml` or `http://10.0.0.1/` made MISP...
- addMISPExportFile() passed the uploaded file's content to Xml::build() with readFile left at its default, so an .xml upload containing `/tmp/x.xml` or `http://10.0.0.1/` made MISP...
🚨 CVE-2026-94404
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.
The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.
If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.
The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.
The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.
Version affected: <2.5.47
🎖@cveNotify
MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change.
The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user.
If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps.
The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page.
The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP.
Version affected: <2.5.47
🎖@cveNotify
GitHub
fix: [security] Keep the CSRF check on the inline attribute field edit · MISP/MISP@dfbae33
- attributes/editField sat in unlockedActions, which skips the field-hash check and the CSRF check alike, so a cross-site form post carrying nothing but the victim's session cookie could re...
🚨 CVE-2026-69617
Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-87235
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSH to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
🎖@cveNotify
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSH to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
🎖@cveNotify
🚨 CVE-2026-87236
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
🎖@cveNotify
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
🎖@cveNotify
🚨 CVE-2026-87241
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
🎖@cveNotify
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
🎖@cveNotify
🚨 CVE-2026-87242
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
🎖@cveNotify
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
🎖@cveNotify
🚨 CVE-2026-87243
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
🎖@cveNotify
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
🎖@cveNotify