PT-2026-82117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the packet reception path where the MAC Port ID is extracted from the RX DMA Descriptor metadata. The helper function cppi5 desc get tags ids incorrectly assigns a...

PT-2026-82297

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via...

PT-2026-82179

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the sloppy-logic-analyzer component of the Linux kernel. The trigger write function dereferences the gpio la poll priv object without taking a debugfs...

CVE-2025-70290

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or...

PT-2026-82056

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a network-connected actor to perform command injection on the host device. Command injection is a flaw where an attacker can execut...

Linux Distros Unpatched Vulnerability : CVE-2026-79087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Injection in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass system access restrictions via a crafted HTML...

CVE-2026-75415

AntFlow V2.0.0 contains an Incorrect Access Control flaw in JiMuMDCCommonsRequestLoggingFilter.java . The file retrieves the user identifier from a request header and uses it as the core of its identity verification mechanism. Because this value is attacker-controllable, an unauthenticated remote...

Linux Distros Unpatched Vulnerability : CVE-2026-79050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML pag...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098979)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098979 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098883)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098883 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUGON in ioeventfd datamatch with getunaligned Drop a BUGON that h...

Linux Distros Unpatched Vulnerability : CVE-2026-79226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-74737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is...

Linux Distros Unpatched Vulnerability : CVE-2026-79077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-032351)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032351 advisory. A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093307)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093307 advisory. Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 an...

Linux Distros Unpatched Vulnerability : CVE-2026-79003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access...

Gitlab -- Vulnerabilities

Gitlab reports: Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE Denial of Service issue in import pipeline impacts GitLab CE/EE Denial of Service issue in SCIM API impacts GitLab EE Improper Access Control issue in protected environments...

NSD -- multiple vulnerabilities

NLnet Labs reports: CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks, Claude and Ada Logics. CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window down to 1. Reported b...

Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...