BIT-MONGODB-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...

BIT-MONGODB-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...

Malicious Package

Overview lc-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

PT-2026-95076

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp affected versions not specified Description Improper input validation allows local users with VPN connection creation permissions to inject arbitrary pppd directives. By providing mru or mtu property values that contain...

PT-2026-95089

Name of the Vulnerable Software and Affected Versions Wavelog versions 1.8 through 2.4.1 Description Wavelog exposes the endpoints '/install/ajax.php' and '/install/includes/interface assets/triggers.php' after installation without requiring an installation lock or permission check. Unsanitized...

CVE-2026-92917: Exposure of Sensitive Information to an Unauthorized Actor

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

PT-2026-94718

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7996 mcu get chip config function within the mt76 wifi driver. The response Type-Length-Value TLV loop advances by the tlv-len value without a minimum threshold,...

PT-2026-94618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use after free UAF issue exists in the arm mpam driver. This occurs when a user unbinds a Memory System Component MSC that is the sole remaining MSC for a component, causing the...

PT-2026-94826

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description When CONFIG CFI CLANG is enabled, the prog-bpf func already skips the kcfi instruction during setup. Including this instruction again in the tailcall jump offset causes the system to jum...

PT-2026-94651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the show pte function when CONFIG DEBUG USER=y and the user debug=31 command line option is enabled. This occurs because a user fault can trigger show pt...

PT-2026-94735

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the swiotlb component where swiotlb alloc tlb may allocate from the DMA atomic pool when a decrypted pool is required from an atomic context. When CONFIG DMA DIRECT...

Geomap MapLibre XSS

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109815 advisory. When using the configparser module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be...

Malicious Package

Overview bender-rspack-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-76444

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table PRRT service. A...

EUVD-2026-81064

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2026-92763 Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths tha...

CVE-2026-92763 Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths tha...

CVE-2026-92763

Rundeck through 6.2.1 contains an authorization bypass in the project archive import endpoint. The importConfig and importNodesSources parameters are not properly authorized, allowing an attacker with only the import action to replace project configuration files, including security-relevant setti...