CVE-2026-92972: Missing Authentication for Critical Function

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

CVE-2026-90321: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...

PT-2026-94400

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow exists in the dm-integrity component. The integrity metadata function computes a checksum for every discarded block into the checksums buffer. Because the integrity...

PT-2026-95100

Name of the Vulnerable Software and Affected Versions Glean versions prior to 0.2.6 Description An issue exists where the application fails to perform network-level validation on URLs provided in RSS feeds. When a user submits a feed url via the 'POST /api/feeds/discover' endpoint, the system...

CVE-2026-90396: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: block: fix dio leak on metadata mapping error A failed integrity mapping holds a dio reference, so we need to go through the full bio ending in case there were previously submitted bio's in the sequence...

CVE-2026-90320: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2validatexattrblock checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xhcount and...

CVE-2026-86707: Improper Authentication

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

PT-2026-94434

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the zero-copy path of the xsk module where TX metadata is read whenever the UMEM has metadata space, regardless of whether the descriptor sets XDP TX METADATA...

VulnCheck KEV: CVE-2026-32255

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch server-side, and returns the...

PT-2026-102926

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.11 Description The PyEnvCfg.write function writes prompt values verbatim to the line-oriented pyvenv.cfg format, while PyEnvCfg. read values parses the file using str.splitlines and accepts the last value for...

CVE-2026-90086: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

PT-2026-94375

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.27.3 Description Authenticated attackers can read arbitrary files by exploiting missing path validation. By providing absolute file paths in the file path parameter, users with valid access tokens can access any fil...

PT-2026-94337

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description When operating in prefill/decode disaggregation mode, the prefill bootstrap service exposes an unauthenticated PUT '/route' endpoint. This allows an attacker to poison the KV transfer routing table b...

CVE-2026-54507: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

PT-2026-94383

Name of the Vulnerable Software and Affected Versions Steeltoe versions 4.0.0 through 4.2.9 Description The ConsulDiscoveryClient parses the secure metadata field of registered service instances using a strict Boolean conversion. If a principal registers a service with a secure value other than...

GHSA-33F5-2C5Q-WGWJ RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

Summary The rmcp library does not validate the resource parameter in OAuth Protected Resource metadata RFC 9728, allowing a malicious MCP server to redirect OAuth flows to a legitimate authorization server and steal the resulting access tokens. Details RFC 9728 specifies two MUST requirements for...

CVE-2026-92795

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

CVE-2026-92774

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...

CVE-2026-92775

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

CVE-2026-76427

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...