PT-2026-79654

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg txt...

CVE-2026-77781 Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

CVE-2026-33240

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

EUVD-2026-64175

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

CVE-2026-33240

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API prior to version 3.2.3 . The flaw allows an attacker to inject malicious scripts that execute in a victim's browser when they interact ...

CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

CVE-2026-53762

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

CVE-2026-53762

VeraCrypt non-default builds compiled with WOLFCRYPT=1 and WOLFCRYPT_BACKEND contain a key-derivation flaw in src/Crypto/wolfCrypt.c. The functions derive_key_sha256 and derive_key_sha512 discard the configured iteration count and substitute wc_HKDF for PBKDF2-HMAC , meaning increasing the PIM or...

CVE-2026-53762 VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

CVE-2026-53762 VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

MAL-2026-14352 Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-77763

JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...

CVE-2026-74567

A flaw was found in the Linux kernel's key management subsystem. An unprivileged local attacker could exploit an out-of-bounds read vulnerability in the keyringgetkeychunk function. By providing specially crafted keys, the attacker can cause the system to read beyond its intended memory boundarie...

WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability

Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...

CVE-2026-16962 Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...