PT-2026-102660

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A malicious remote peer can flood the local QUIC stack with NEW CONNECTION ID frames by bypassing the limit check on the number of connection IDs the remote stack can use. The local stack...

ROS-20260929-73-0100

The vulnerability of the privcmdinit function in the drivers/xen/privcmd.c module of the Linux kernel is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

PT-2026-102663

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host versions prior to 15.82 Description An improper access control weakness in the software allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By...

ROS-20260929-73-0029

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-102568: Incorrect Authorization

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...

QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

CVE-2026-102711: Out-of-bounds Read

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-75804: Allocation of Resources Without Limits or Throttling

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

PT-2026-102937

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description A memory exhaustion issue exists in the NCCL control channel when the software is started with the --pd trans mode nccl configuration. Unauthenticated attackers can exploit this by calling the expos...

PT-2026-102617

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-75804: Allocation of Resources Without Limits or Throttling

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

PT-2026-109068

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

Amazon Linux 2 : 389-ds-base (ALAS-2026-3956)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3956 advisory. A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's...

CVE-2026-79417: Improper Access Control

Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRPMJCREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service...

CVE-2026-79417

Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRPMJCREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service...

PT-2026-108451

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true...

PT-2026-109062

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW CONNECTION ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE CONN ID frame for every NEW CONNECTION ID frame it receives...

ROS-20260929-73-0105

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260929-73-0107

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-93332: Missing Authorization

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...