CVE-2025-70290

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or...

Linux Distros Unpatched Vulnerability : CVE-2026-79003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access...

CVE-2026-26447

Stomper (commit 5e2741e ) contains a heap use-after-free vulnerability in its STOMP broker's subscription management. When a single client repeatedly sends SUBSCRIBE commands for the same destination and then disconnects, the broker incorrectly cleans up its internal subscription structures. The ...

Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...

PT-2026-82117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the packet reception path where the MAC Port ID is extracted from the RX DMA Descriptor metadata. The helper function cppi5 desc get tags ids incorrectly assigns a...

PT-2026-82297

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via...

PT-2026-82179

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the sloppy-logic-analyzer component of the Linux kernel. The trigger write function dereferences the gpio la poll priv object without taking a debugfs...

Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

VulnCheck KEV: CVE-2026-49869

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath.endsWith"/configs" to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match...

PT-2026-82096

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An issue exists where an authenticated user with developer-role permissions can influence the execution environmen...

NSD -- multiple vulnerabilities

NLnet Labs reports: CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks, Claude and Ada Logics. CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window down to 1. Reported b...

Gitlab -- Vulnerabilities

Gitlab reports: Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE Denial of Service issue in import pipeline impacts GitLab CE/EE Denial of Service issue in SCIM API impacts GitLab EE Improper Access Control issue in protected environments...

PT-2026-82056

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a network-connected actor to perform command injection on the host device. Command injection is a flaw where an attacker can execut...

PT-2026-82240

Name of the Vulnerable Software and Affected Versions Denx U-Boot versions prior to 2026.04 Description An integer overflow exists in the ZFS filesystem support, which can be triggered by malformed on-disk metadata. This flaw may lead to incorrect memory allocation and subsequent out-of-bounds...

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...

EUVD-2025-210793

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or...

PT-2026-82099

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.3 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 Description An improper authorization check allows an authenticated user with project Maintainer permissions to access the terminal of a...

PT-2026-82369

Name of the Vulnerable Software and Affected Versions Drupal Digital Signage Framework versions 0.0.0 through 2.6.1 Description A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if...

EUVD-2025-210802

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers...

CVE-2026-75413

DocSys V2.02.80 contains an Any File Download vulnerability in the downloadDocEx.do interface. An unauthenticated attacker can exploit the targetPath parameter to download arbitrary files over the network without any prior authentication. The CVSS 3.1 score is 7.5 (HIGH) , reflecting a network at...