PT-2026-110411

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total amount results in business log...

PT-2026-111111

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable msg.c shares three intrusive lists busy ctx, free ctx, free chunks and one k work delayable between two cooperative threads with no synchronization: bt mesh delayable msg manage runs on the Bluetooth host R...

PT-2026-110700

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

CVE-2026-59977: Cross-Site Request Forgery (CSRF)

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...

PT-2026-110894

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

PT-2026-110710

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of...

Important: openssl

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

CVE-2026-108784: Undefined Security Weakness

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument totalamount results in business logi...

FreeBSD : Gitlab -- vulnerabilities (5518664d-c652-11f1-b273-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5518664d-c652-11f1-b273-2cf05da270f3 advisory. Gitlab reports: Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3196 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2026-029)

The version of tomcat installed on the remote host is prior to 9.0.122-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2026-029 advisory. Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS...

CVE-2026-109175: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/xe/uapi: Reject cohnone PAT index for CPU cached memory in madvise CVE-2026-46309 kernel: macsec: fix replay protection at XPN lower-PN wrap CVE-2026-63925 kernel: bpf: Support for...

ALSA-2026:81552 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/xe/uapi: Reject cohnone PAT index for CPU cached memory in madvise CVE-2026-46309 kernel: macsec: fix replay protection at XPN lower-PN wrap CVE-2026-63925 kernel: bpf: Support for...

CVE-2026-109391: Deserialization of Untrusted Data

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored...

CVE-2026-109575: Missing Authentication for Critical Function

In HAProxy Data Plane API 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases, Server.ConfigureAPI has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority tlsca is configured and a numeric TLS...

CVE-2026-109283: Incorrect Authorization

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a...

PT-2026-110562

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting...

PT-2026-110579

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content...

PT-2026-111017

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send sms to send arbitrary S...