Linux Distros Unpatched Vulnerability : CVE-2026-98685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: discard post-EOF pagecache when extending a file via clone range cifsremapfilerange discarded the pagecache only for the folios overlapping the...

Linux Distros Unpatched Vulnerability : CVE-2026-98686

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791971338)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791971338 advisory. - rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destinatio...

MLflow 3.17.1 and Prior StartTrace Path Traversal

MLflow version 3.17.1 and prior versions using the FileStore tracking backend contain a path traversal vulnerability in the StartTraceV3 API. The proof of concept submits a traversal trace ID and demonstrates trace files written outside the intended trace directory...

PT-2026-116997

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the binder module where a TF UPDATE TXN transaction superseding a pending async transaction triggers binder release entire buffer with the is failure flag set to false...

PT-2026-128645

In the Linux kernel, the following vulnerability has been resolved: binder: fix is failure flag for superseded transaction cleanup When a TF UPDATE TXN transaction supersedes a pending async transaction, binder release entire buffer is called with is failure=false. Since the superseded transactio...

Linux Distros Unpatched Vulnerability : CVE-2026-98778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer i...

CVE-2026-112016: Missing Authentication for Critical Function

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...

PT-2026-128388

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TF UPDATE TXN supersede When a TF UPDATE TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binder free tx...

Exploit for CVE-2026-53995

CVE-2026-53995: MLflow starttracev3 - TraceInfo.from...

CVE-2026-111929

Coder versions 2.30.0 before 2.34.8 are vulnerable to a cross-organization file disclosure flaw in the provisioner daemon's DownloadFile gRPC handler . An authorization bypass allows authenticated provisioner daemons to download cached Terraform module archives belonging to other organizations. B...

CVE-2026-111929 Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111929 Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111929 Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111897 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a...

CVE-2026-111897

The software phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta is vulnerable to an authorization bypass in the attachment administration endpoints. The root cause is a failure to properly restrict actions based on user categories, allowing editors with medium permission mode to manage attachments f...

cups: cups: Arbitrary file overwrite via insecure temporary file handling

A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying wheth...

Netcore NR256CN Authorization Issue Vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have an authorization issue vulnerability. This vulnerability stems from an unvalidated file writing vulnerability in the /bin/boa web server, derived from Boa. Attackers can send POST requests to non-existent .cgi paths, thereby writing...

Hrisikesh Pal Blood_Bank_Management_System Cross-site Scripting Vulnerability

Hrisikesh Pal BloodBankManagementSystem 1.0.0 has a security vulnerability. This vulnerability stems from incorrect handling of parameters in the Search field within the file/abs.php, which may lead to cross-site scripting attacks...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.13 contains a security vulnerability. This vulnerability arises from the use of an invalid pstate pointer after the nvkmclkustateupdate function does not hit a break in the listforeachentry loop. In user space, it is possible to request an non-existent pstate ID through...