PT-2026-55605

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.0 Description The software does not fail closed when encountering bufio.Scanner errors during the processing of pre-receive hook input. This behavior allows oversized input to bypass branch-protection checks...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to execute arbitrary code.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

MAL-2026-6719 Malicious code in ts-clob-math-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9 On npm install, the postinstall script scripts/install-check.cjs resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.ap...

PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions

A flaw was found in PHP. Some functions, including urldecode, incorrectly pass signed characters to character type ctype functions. On certain systems, this can lead to accessing memory with a negative offset. This vulnerability can be exploited by an attacker to trigger a denial of service DoS,...

Vulnerability of the dmc620_pmu_init() function in the drivers/perf/arm_dmc620_pmu.c module of the Linux kernel’s performance monitoring driver, which allows a hacker to cause a system failure.

The vulnerability of the dmc620pmuinit function in the drivers/perf/armdmc620pmu.c module of the Linux kernel’s performance monitoring driver is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2026-56334 Capgo - Missing UPDATE RLS Policy for Build Status Persistence

Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...

Vulnerabilities found in Apple iOS and iPadOS

Apple has identified several vulnerabilities in iOS and iPadOS. These vulnerabilities include out-of-bounds access, use-after-free errors, memory handling issues, insufficient input validation, type confusion, double-free operations, stack overflows, race conditions, and path handling problems...

Multiple Mozilla product logic processing errors (CNVD-2026-26387)

Mozilla Firefox is an open-source web browser. Mozilla Firefox ESR is a extended support version of Firefox the web browser. Mozilla Thunderbird is an email client software that emerged independently from the Mozilla Application Suite. Several Mozilla products have vulnerabilities related to...

Multiple Mozilla product logic processing errors (CNVD-2026-26878)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox ESR is an extended support version of Firefox the web browser developed by the Mozilla Foundation. Mozilla Thunderbird is an email client software independently developed from t...

The vulnerability of the bpf_prog_attach() function in the kernel/bpf/syscall.c module, which is part of the BPF interpreter support for the Linux operating system’s kernel, allows a hacker to trigger a service failure.

The vulnerability of the bpfprogattach function in the kernel/bpf/syscall.c module, which is part of the BPF interpreter support for Linux’s operating system, is related to errors during the update of the reference counter. Exploiting this vulnerability could allow an attacker to trigger a servic...

CVE-2026-57958

Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs with unsanitized error query parameters. Attackers can exploit the OAuth...

EUVD-2026-40095

A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument itemprice can lead to business logic errors. The attack may be performed from remote. The exploit has been published...

CVE-2026-13571 SourceCodester Simple Food Ordering System cart.php logic error

A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument itemprice can lead to business logic errors. The attack may be performed from remote. The exploit has been published...

PYSEC-2026-307 calibre-web is vulnerable to Business Logic Errors

calibre-web is vulnerable to Business Logic Errors...

CVE-2026-53284

A flaw was found in the Linux kernel's Btrfs filesystem. A local user performing specific filesystem operations could trigger an error during the writing of dirty extent buffers. This improper handling of the dirty pages I/O tree can prevent unsubmitted records from being cleaned up, leading to...

BIT-HAPROXY-2026-55203 HAProxy - Integer Overflow in FCGI Demux Record Length Field

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record...

The vulnerability of the BIND DNS server, related to resource release errors, allows a hacker to cause a service failure.

The vulnerability of the BIND DNS server is related to resource release errors. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2026-53495

Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | |...

nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

...

The vulnerability of the ublk_check_and_reset_active_ref() function in the drivers/block/ublk_drv.c module of the Linux kernel’s block devices driver allows a attacker to cause a service failure.

The vulnerability of the ublkcheckandresetactiveref function in the drivers/block/ublkdrv.c file, a driver for block devices in the Linux operating system, is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause service failures...