Incorrect Authorization in Synology DSM Security Advisor Allows Remote File Read

An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files.

JVM Options Injection Enables Command Execution in JetBrains Datalore Database Tasks

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

Improper Authorization Enables Retrieval of Notebook Owner's File Storage Session Token

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

Unauthorized Download of Private Notebook Files via Published Interactive Reports in JetBrains Datalore

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

Stored Cross‑Site Scripting via Vega Editor Link in JetBrains Datalore

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.

Improper Authorization in JetBrains Datalore Allowing File Modification by Notebook Viewers

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-rollback fuse updates due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In getChppAppState of chpp_init.cc, there is a possible way to trigger an out of bounds read and corrupt task control structures due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a possible way to leak host code pointers to a guest virtual machine due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Hidden Notebook Code Exposure via Public Endpoint

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

Improper owner validation in JetBrains Datalore allows cross‑workspace data reading

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.