PT-2026-69801

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm ffa firmware component where the ffa setup and transmit function performs out-of-bound writes. This occurs because writing to ep mem access-reserved can exceed...

PT-2026-69640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A device mapping leak occurs in the drm/gpusvm component. The drm gpusvm get pages function only stores the local dpagemap into svm pages-dpagemap upon successful completion. If a...

PT-2026-69471

Name of the Vulnerable Software and Affected Versions CoreBunch/Instatic versions 0.0.1 through 0.0.14 Description An unauthenticated remote attacker can poison the shared process-wide render cache. By manipulating the u query parameter of the GET '/ instatic/hole/' server island endpoint, an...

PT-2026-69850

Name of the Vulnerable Software and Affected Versions MISP cti-transmute affected versions not specified Description An issue exists where the account following-list endpoint discloses the email addresses of users. When an authenticated user follows another account, the get following function...

PT-2026-69756

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A division by zero occurs in the airoha watchdog driver when the clock frequency is zero. This happens because the clk get rate function can return 0 if the clock provider is unmanaged o...

PT-2026-69572

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture where the huge ptep get function fails to properly handle unaligned virtual addresses pointing to the middle of a contpmd or contpte mapped...

PT-2026-69549

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtual file system VFS helper forget cached acl where it fails to preserve the ACL DONT CACHE state. This state is intended to be constant for inodes in filesyste...

CVE-2026-19357

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and...

CVE-2026-19357

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and...

EUVD-2026-54928

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and...

CVE-2026-19357 MingSoft MCMS ms-mdiy get information disclosure

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and...

CVE-2026-19330

A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function createsystemjson/createlibrary to getsystemjson/switchmemorylibrary of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was...

CVE-2026-19357: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and...

PT-2026-69298

Name of the Vulnerable Software and Affected Versions MingSoft MCMS versions prior to 3.0.7 Description A security flaw in the ms-mdiy component allows remote attackers to cause information disclosure. The issue resides within an unknown function of the '/mdiy/form/get' endpoint. Recommendations ...

CVE-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

CVE-2026-11742 Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock

The kernel queue helper zqueuenodepeek in kernel/queue.c dereferences a node taken from a queue's dataq list, reading the node's flag byte and, for items enqueued via kqueueallocappend/allocprepend, the data pointer of an internally allocated allocnode struct. The implementations of...

CVE-2026-18497

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...

Missing Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization in the actionGetNewUsersData process. An attacker can access aggregate user registration metrics by sending POST requests to the /actions/charts/get-new-users-data...

GHSA-RVMM-V933-JGXQ Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...