PT-2026-106510

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An out-of-bounds write exists in the gud plane atomic check function. The issue occurs because the plane property loop incorrectly calculates the write index using req-propertiesnum...

Linux Distros Unpatched Vulnerability : CVE-2026-98221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded...

Linux Distros Unpatched Vulnerability : CVE-2026-98171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in...

CVE-2026-105783: Origin Validation Error

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-106511: Missing Authentication for Critical Function

MultiversX's multisig-improved repository: mx-multisig-and-modules reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. Thi...

PT-2026-107166

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An incorrect authorization weakness exists in a configurable, non-default privilege that allows administrators to delegate limited role-management capabilities to other users scoped to...

PT-2026-106352

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A cryptographic issue occurs when processing non-ELF Executable and Linkable Format partitions. This flaw allows authentication and signature checks to be...

CVE-2026-95105: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR...

CVE-2026-98221: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

Linux Distros Unpatched Vulnerability : CVE-2026-98291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex...

PT-2026-107117

Name of the Vulnerable Software and Affected Versions multisig-improved repository: mx-multisig-and-modules affected versions not specified Description The reference implementation of the on-chain multisig smart contract system contains a flaw where a missing independent authorization check allow...

CVE-2026-25302: Improper Verification of Cryptographic Signature

Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed...

PT-2026-106550

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the trusted keys subsystem where the tpm2 load cmd function performs boundary checks against the ASN.1 size, specifically the payload-blob len variable, rather than th...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

EUVD-2026-92870

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via unvalidated image layer DiffIDs through the setBlob and snapshot identity handling in cache/blobs.go, cache/metadata.go, and cache/refs.go. An attacker can cause a later build to mount...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via unvalidated image layer DiffIDs through the setBlob and snapshot identity handling in cache/blobs.go, cache/metadata.go, and cache/refs.go. An attacker can cause a later build to mount...