CVE-2026-54258: Authorization Bypass Through User-Controlled Key

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

CVE-2026-89173: Observable Response Discrepancy

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

CVE-2026-89248: Exposure of Sensitive Information to an Unauthorized Actor

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

ROS-20260911-73-0154

The vulnerability of the Animation component in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-90507

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description Tokens obtained through delegated authentication methods, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts, are not restricted from creating, modifying...

CVE-2026-89642: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecacheisizeextended in cifssetsize when extending cifssetsize calls truncatepagecache but skips pagecacheisizeextended on extension. truncatesetsize shows the correct pattern: isizewriteinode, newsize; if newsize...

PT-2026-90358

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CIFS component where the cifs setsize function fails to call pagecache isize extended during file extension. While cifs setsize invokes truncate pagecache, it omit...

PT-2026-96602

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache isize extended in cifs setsize when extending cifs setsize calls truncate pagecache but skips pagecache isize extended on extension. truncate setsize shows the correct pattern: i size writeinode, newsize; if...

PT-2026-89880

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

ROS-20260911-73-0145

The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-90501

Name of the Vulnerable Software and Affected Versions Mousehole versions prior to 0.4.05 Description Mousehole is a background service used to update a seedbox IP for MyAnonamouse MAM and a web app for its management. The HTTP/WebSocket management boundary is accessible without application-layer...

CVE-2026-50025: Exposure of Sensitive Information to an Unauthorized Actor

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

ROS-20260911-73-0156

The vulnerability of the Skia component in Google Chrome and Microsoft Edge relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-90594

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.107 Description The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress allows unauthenticated attackers to extract...

ROS-20260911-73-0158

The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-90407

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the nfsd4 release compoundargs function. When the dynamically-allocated ops buffer is freed, the function resets args-ops to the inline iops8 array but...

PT-2026-96550

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr count read segments checks only 4-byte...

CVE-2026-89298: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-79394

The Xiongmai IP Camera XM530 is vulnerable to unauthorized data access due to an insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon. Specifically, firmware version HMT.CM2005-v220608.1837 and earlier ships with authentication disabled . This allows re...

ROS-20260911-73-0115

The vulnerability of Chromecast web browsers Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...