CVE-2026-56708: Time-of-check Time-of-use (TOCTOU) Race Condition

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

FreeBSD Security Advisory - FreeBSD-SA-26:56.hwpmc

FreeBSD Security Advisory - When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly...

PT-2026-81319

Name of the Vulnerable Software and Affected Versions praisonaiagents versions prior to 1.6.58 Description In the AgentServer component, the ServerConfig.auth token variable is exposed but not validated by the AgentServer. create app function across any routes. This allows a remote caller to...

FreeBSD : mod_gnutls -- multiple vulnerabilities (a7b4cdfc-9f9d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a7b4cdfc-9f9d-11f1-a655-3497f65b111b advisory. The modgnutls project reports: Security fix CVE-2026-33307: Fix out-of-bounds write when...

Linux Distros Unpatched Vulnerability : CVE-2026-48820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0...

CVE-2026-75803: Improper Validation of Integrity Check Value

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

EulerOS Virtualization 2.13.0 : haveged (EulerOS-SA-2026-3214)

According to the versions of the haveged packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In src/havegecmd.c, the sockethandler function performs a credential check on the abstract UNIX socket \0/sys/entropy/haveged...

PT-2026-81242

Name of the Vulnerable Software and Affected Versions Industry Directory yellowpages2 affected versions not specified Description The company self-service editing feature fails to perform server-side ownership verification during write operations. While the frontend uses a visibility flag to hide...

PT-2026-81245

Name of the Vulnerable Software and Affected Versions Events 2 affected versions not specified Description Broken access control exists in the frontend management update flow. The system verifies a different event than the one actually being modified, allowing a user with frontend event managemen...

PT-2026-81243

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The frontend topic editing flow fails to perform server-side verification to ensure the requesting visitor owns the topic being modified. An attacker can obtain ...

CVE-2026-78467: Undefined Security Weakness

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

PT-2026-81241

Name of the Vulnerable Software and Affected Versions Club Directory affected versions not specified Description Broken access control exists in the frontend edit, update, and activate actions. The extension resolves the targeted club record from a user-supplied request argument but fails to...

PT-2026-81927

Name of the Vulnerable Software and Affected Versions OpenBSD hwpmc affected versions not specified Description An issue exists in the hwpmc4 driver where an inverted check occurs when a process calls execve2 to execute a setuid or setgid image. This failure to properly detach Performance...

...[ More ]

This Metasploit module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an...

PT-2026-81294

Name of the Vulnerable Software and Affected Versions YOOtheme Pro versions 1.0.0 through 5.0.41 Description A missing access check allows authenticated users with com template editing permissions to access information about arbitrary modules, even if they lack the required com modules permission...

Squashfs Heap Buffer Overflow DoS

The vulnerability in the squashfsreadmetadata function within the fs/squashfs/cache.c file of the Squashfs filesystem module in the Linux kernel is related to improper validation of specified indices, positions, or offsets in input data. Exploitation of this vulnerability may allow an attacker to...

Linux kernel Block Crypto Evict Key

The vulnerability of the blkcryptoevictkey function in the block/blk-crypto.c module, which is part of the Linux kernel’s block-level support, is related to an incorrect check on the returned value. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

HTTP File Server getDiskSpaceSync Arbitrary Command Execution

The vulnerability of the getDiskSpaceSync function, which is responsible for determining free disk space on the HTTP File Server 3 file server, is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

Linux Rxkad Decrypt Ticket Use-After-Free

The vulnerability in the rxkaddecryptticket function within the net/rxrpc/rxkad.c module, which handles RxRPC session sockets on Linux operating systems, stems from a lack of validation of return values. Exploitation of this vulnerability enables a remote attacker to compromise the confidentialit...

EulerOS Virtualization 2.13.1 : samba (EulerOS-SA-2026-3197)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...