PT-2026-93470

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs component where the f2fs sanity check node footer function does not receive the folio-index value. This leads to the incorrect checking of the same nid node...

PT-2026-93561

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue in the KVM s390 component allows memory corruption due to the reinjection of CK machine checks. Channel-subsystem damage machine checks are intended for the host channel...

PT-2026-93314

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-73459: Improper Validation of Integrity Check Value

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss...

CVE-2026-87828: Uncontrolled Resource Consumption

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-61593: Cross-Site Request Forgery (CSRF)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...

CVE-2026-92136: Improper Neutralization of Input During Web Page Generation

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-89829: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio-index to f2fssanitychecknodefooter Otherwise in f2fssanitychecknodefooter, it will check the same nid incorrectly...

CVE-2026-89839: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fsxattradviseset f2fsxattradviseset calls inodeownerorcapable with &nopmntidmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to t...

CVE-2026-42784: Improper Verification of Cryptographic Signature

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

PT-2026-93305

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

PT-2026-93369

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.13.2 through 1.26.1 Description Zones configured with zonemd-check: yes that are located below a trust anchor contain a flaw where tampered zone contents may be served or stored to disk before the ZONEMD integrity...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38402)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from improper access control in the CloudSrvVersionCheck function. Attackers can exploit this vulnerability by sending a specially crafted POST...

PT-2026-93854

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.3 Description The REST API user creation endpoint 'POST /ccm/api/1.0/users', specifically the add function in concrete/src/Api/Controller/Users.php, fails to perform a permission check before creating an...

PT-2026-93779

Name of the Vulnerable Software and Affected Versions Jenkins OWASP Dependency-Check Plugin versions prior to 5.6.5 Description The Jenkins UI fails to escape CWE values from Dependency-Check reports, leading to a stored cross-site scripting XSS issue. This allows attackers with Item/Configure...

PT-2026-93729

Name of the Vulnerable Software and Affected Versions Check Point Security Management Server affected versions not specified Check Point Multi-Domain Security Management affected versions not specified Check Point Log Server affected versions not specified Description A stack-based buffer overflo...

PT-2026-94119

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description For views that utilize state snapshots, the state json snapshot embedded in the client page is restored upon reconnection as trusted view state without an integrity check. This allows a client to modif...

PT-2026-93313

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

PT-2026-93459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the drm/amdgpu/vcn component during the dec msg buffer count check. When the num buffers variable is set to 0x3FFFFFFF, the calculation 6 + num buffers 4...

PT-2026-93529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ov02a10 check hwcfg function. The function calls fwnode handle putep immediately after allocating and parsing the endpoint, but then attempts to use...