CVE-2026-79762: Use of Hard-coded Cryptographic Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-47132: Improper Input Validation

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

PT-2026-97709

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.2 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if the authenticated user requesting course-progress records is the actual owner of those records. This allows...

PT-2026-97731

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description An authorization bypass exists due to the use of a user-controlled key. Recommendations Update to version 1.11.00.022 or later...

CVE-2026-82850: Exposure of Sensitive Information to an Unauthorized Actor

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-97476: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2026-48073: Authorization Bypass Through User-Controlled Key

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

PT-2026-97920

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix derives keys used to wrap Data Encryption Keys DEK for OIDC and WebAuthn users from committed default strings and the public userId salt within the src/backend/utils/user-crypto.ts file...

PT-2026-97646

Name of the Vulnerable Software and Affected Versions Paytium: Mollie payment forms & donations plugin for WordPress versions prior to 5.0.4 Description A privilege escalation issue exists where unauthenticated attackers can register a new WordPress account with administrator privileges. The flaw...

PT-2026-97796

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description A deadlock condition exists that can be triggered by authenticated users. This issue is caused by a lock management bug within the user management module. A deadlock is a situation where...

PT-2026-97691

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.98.0 through 0.142.0 Description When configured to use the opaque session tokenizer, the system fails to revoke existing login sessions during password resets or user deletions. This occurs because the DeleteTokensByUserID...

Linux Distros Unpatched Vulnerability : CVE-2026-97476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns:...

CVE-2026-89078 Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-89078 Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-92530 Use of Less Trusted Source in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92529

An improper authorization check in GitLab EE allows an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls . This vulnerability specifically affects workflows in namespaces that the user does not control. The issue is present in versions 19.1 ...

CVE-2026-92874 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due ...

CVE-2026-92628

GitLab CE/EE versions 18.6 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are affected by a race condition in the MCP search tool . Improper synchronization during shared state handling could lead to search results being returned under an incorrect user context . GitLab has remediate...

CVE-2026-92628 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...