CVE-2026-79418

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...

PT-2026-85776

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters...

CVE-2026-71625

CVE-2026-71625 affects slimkit plus ThinkSNS+ v.2.4 , a social network platform. The vulnerability resides in the ResetPasswordController.php component and allows a remote unauthenticated attacker to escalate privileges. The vendor's advisory describes the root cause as account takeover via expir...

CVE-2021-44319

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to a Wi-Fi deauthentication attack that allows a remote, unauthenticated attacker to disconnect the drone from its controller during mid-flight, resulting in a Denial of Service . The vulnerability is rated CVSS 7.5 (HIGH) with a network attack vect...

PT-2026-86248

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component...

The vulnerability of the sctp_unpack_cookie() function in the net/sctp/sm_make_chunk.c module of the Linux operating system’s SCTP kernel implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sctpunpackcookie function in the net/sctp/smmakechunk.c module of the Linux operating system’s SCTP protocol implementation is related to improper handling of length parameter mismatches. Exploiting this vulnerability allows a remote attacker to compromise the...

The vulnerability of the copy_context_work_handler() function in the drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c file of the Direct Rendering Infrastructure (DRI) driver for AMD graphics cards in the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the copycontextworkhandler function in the drivers/gpu/drm/amd/amdkfd/kfddevicequeuemanager.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to improper resource release. Exploiting this vulnerability could...

The vulnerability of the crush_decode() function in the net/ceph/osdmap.c kernel of the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the crushdecode function in the net/ceph/osdmap.c module of the Linux kernel is related to incorrect assumptions regarding the organization of data or memory. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106209)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106209 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server:...

CVE-2026-71626

Invoice Ninja v5.13.24 is affected by a vulnerability in its webhook API components (StoreWebhookRequest.php , UpdateWebhookRequest.php , and WebhookSingle.php ) that allows a remote, unauthenticated attacker to obtain sensitive information. The vendor's advisory classifies the issue as SSRF via ...

Linux Distros Unpatched Vulnerability : CVE-2026-85049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

CVE-2026-75160

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

EUVD-2026-71455

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

EUVD-2026-71443

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-75439

An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component...

CVE-2026-75160

CVE-2026-75160 is a critical remote privilege escalation vulnerability in MBS Solutions X-Serie Gateway running Firmware V6_00_05 . The vulnerability is exploitable via the web endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi, allowing a remote, unauthenticated attacker to escalate priv...

PT-2026-86240

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be use...

The vulnerability of the onie_tlv_add_cells() function in the drivers/nvmem/layouts/onie-tlv.c driver for NVMEM devices (energy-independent memory in the Linux operating system’s kernel) allows a attacker to cause a service failure.

The vulnerability of the onietlvaddcells function in the drivers/nvmem/layouts/onie-tlv.c driver for NVMEM an energy-independent memory technology in the Linux operating system is related to the execution of a loop with an unreachable exit condition “Infinite loop”. Exploiting this vulnerability...

PT-2026-86245

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components...

CVE-2026-75170

This stored XSS affects the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1 ). A remote unauthenticated attacker can inject arbitrary JavaScript by manipulating the language POST parameter , causing the application's response to execute attacker-controlled script in the ...