ROS-20260911-73-0030

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

CVE-2025-69904

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...

PT-2026-90016

Name of the Vulnerable Software and Affected Versions Linkstack versions prior to 4.8.5 Description Path Traversal allows an administrator to read arbitrary files on the server by manipulating file path input. This issue can lead to unauthorized access to sensitive system or application files...

PT-2026-90287

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CXL features of the Linux kernel where the cxlctl fw rpc callback fails to validate the user-controlled op size variable against the input buffer length in len. In...

PT-2026-90329

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The NTFS driver fails to properly handle attributes containing empty mapping pairs when there is an inconsistency between the highest Virtual Cluster Number VCN, which is the index of th...

ROS-20260911-73-0238

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

PT-2026-90055

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. Th...

ROS-20260911-73-0230

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-90547

Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...

PT-2026-90000

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure bu...

PT-2026-90300

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the block subsystem where bio-based drivers may fail to check alignment splits, and stacking block drivers may not properly handle misalignment detected after bio...

PT-2026-90661

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.5.0 Description Stored Cross-Site Scripting occurs via multiple Elementor widgets due to insufficient input sanitization and output escaping on the load manually parameter within...

PT-2026-90373

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel libceph, the osd sparse read function in net/ceph/osd client.c fails to validate that each OSD-supplied extent is monotonic and remains within the original request...

PT-2026-96497

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

PT-2026-90210

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description In the ocfs2 module, a node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. Specifically, the num locks and...

ROS-20260911-73-0056

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0122

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-89857

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute...

PT-2026-89854

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start request...

PT-2026-89842

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...