PT-2026-70216

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.77.2 Description The VQL query plugin allows executing a VQL query within a different organization or user context. To perform this action, the calling user must possess the IMPERSONATE permission. The issue...

PT-2026-70927

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

CVE-2026-73084: Improper Neutralization of Input During Web Page Generation

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

PT-2026-70851

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in geospatial query processing allows an authenticated user with write privileges to store malformed geometry data that is processed without proper validation. Subsequent...

CVE-2026-72914

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

EUVD-2026-55837

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914

Mastodon prior to versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 exposes a resource exhaustion risk via administrative statistics endpoints (Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController). Anonymous callers can pass keys, start_at, and end_at to trigger long-running...

CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

CVE-2026-69114

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

CVE-2026-63106 ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

EUVD-2026-55269

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088 usb: gadget: function: rndis: add length check to response query

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68088

The CVE describes a Linux kernel usb gadget rndis vulnerability where the rndis_query_response() path now validates BufLength and BufOffset (introducing a length check) to match the handling in rndis_set_response(). The vulnerability affects the rndis function of the USB gadget subsystem in the L...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...