PT-2026-71717

Name of the Vulnerable Software and Affected Versions Podman version 5.8.x Description The podman quadlet install --replace command fails to truncate existing destination files when opening them with O CREATE|O WRONLY without O TRUNC. On filesystems that do not support reflinks, such as many...

CVE-2026-58437: Improper Access Control

Repository Visibility Manipulation via Git Push Options...

PT-2026-71961

Name of the Vulnerable Software and Affected Versions Astro Booking Engine versions prior to 1.4.1 Description The Astro Booking Engine plugin for WordPress contains a Cross-Site Request Forgery CSRF flaw. This occurs because the options deletion functionality lacks nonce validation—a security...

undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security TLS certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently...

CVE-2026-16931

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options...

CVE-2026-16931 IBM i is Affected By A Denial of Service Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options...

EUVD-2026-57376

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options...

CVE-2026-16931 IBM i is Affected By A Denial of Service Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options...

CVE-2026-16931

CVE-2026-16931 affects IBM i releases 7.6, 7.5, 7.4 and 7.3. A remote attacker could cause a denial of service through improper handling of zero-length TCP options. The vulnerability has a CVSS v3.1 base score of 7.5 (NETWORK, HIGH impact on availability; no impact on confidentiality/integrity). ...

CVE-2026-18049 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...

CVE-2026-18049

The WP Photo Album Plus WordPress plugin, in versions prior to 9.2.07.002 , is vulnerable to an unauthenticated option disclosure via the gettogo endpoint. The flaw exists because the plugin fails to perform capability or nonce checks on a public endpoint action and constructs an option name usin...

PT-2026-71184

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options...

PT-2026-76561

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.87.0 Description The target search endpoint POST /api/latest/fleet/targets fails to sanitize data for users with Observer, Observer+, or Technician roles. This allows these users to retrieve unmasked team enroll secre...

CVE-2026-16931: Loop with Unreachable Exit Condition

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options...

CVE-2026-18049: Exposure of Sensitive Information to an Unauthorized Actor

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...

PT-2026-71021

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.07.002 Description An issue exists where the plugin fails to perform capability or nonce checks on a public endpoint action. The software constructs an option name using a client-supplied value without...

Security Bulletin: IBM i is Affected By A Denial of Service Vulnerability [CVE-2026-16931]

Summary IBM i is vulnerable to a denial of service due to improper handling of TCP options CVE-2026-16931 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16931 DESCRIPTION: IBM i could allow a remote attacker to cause a denial of service due to improper...

CVE-2026-68119

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

CVE-2026-14941

The Customer Reviews for WooCommerce WordPress plugin (versions before 5.116.0 ) is vulnerable to an authorization bypass due to missing nonce or capability checks on multiple settings-related AJAX actions . This allows users with minimal permissions, such as Subscribers , to invoke administrativ...