CVE-2026-6486

A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed...

OESA-2026-1972 giflib security update

giflib is a library of gif images and provides utilities for processing images. Security Fixes: Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but...

CVE-2026-6483 Wavlink WL-WN530H4 internet.cgi snprintf os command injection

A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used...

EUVD-2026-23382

The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions function, which is exposed via two AJAX hooks: wpajaxupdateOptions class-canto.php line 231 an...

jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()

...

OSV-2026-579 Heap-buffer-overflow in CEA708_DTVCC_Demuxer_Push

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=502906444 Crash type: Heap-buffer-overflow READ 1 Crash state: CEA708DTVCCDemuxerPush DoDecode Decode...

PT-2026-35469

An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service DoS via the convert function of exrmultipart.cpp...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007284)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007284 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix null pointer dereference on pointer csdesc The pointer csdesc return from...

ROS-20260417-73-0013

A vulnerability in the commonprefix function of the pip module of the Python programming language is related to an incorrect directory path name restriction. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to add and modify arbitrary files...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007574)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007574 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can request...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007260)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007260 advisory. In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007493)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007493 advisory. In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmuxops::getfunctionname While the API contract in docs...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007433)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007433 advisory. In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovldentryweird functio...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007279)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007279 advisory. In the Linux kernel, the following vulnerability has been resolved: iavf: free qvectors before queues in iavfdisablevf iavffreequeues clears adapter-numactivequeues,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007622)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007622 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f PCI/ASP...

PT-2026-33435

A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used...

PT-2026-33456

Name of the Vulnerable Software and Affected Versions arnobt78 Hotel Booking Management System versions prior to d47ae0e27c700b64dc417f7f01b84a6b1b0b6bd3 Description An issue in the Health Check Endpoint component allows remote exploitation through the manipulation of an unknown function within t...

ROS-20260417-73-0032

A vulnerability in the futimes function of the Node.js software platform is related to a flaw in the authorization procedure. Exploitation of the vulnerability could allow an attacker to gain access to modify files...

PT-2026-36794

Name of the Vulnerable Software and Affected Versions Totolink N300RH version 3.2.4-B20220812 Description A buffer overflow can be triggered remotely via the POST Request Handler component. The issue exists in the setWanConfig function within the '/cgi-bin/cstecgi.cgi' endpoint when manipulating...

PT-2026-37126

Name of the Vulnerable Software and Affected Versions math-codegen versions prior to 0.4.3 Description String literal content passed to the cg.parse function is injected verbatim into a new Function body without sanitization. This allows an attacker to execute arbitrary system commands when...