CVE-2026-108374

The ERPNext enterprise resource planning tool is vulnerable to unauthorised status modification in versions prior to 15.121.0 and 16.34.0 . The root cause is a missing authorization check in certain endpoints used for status modification. A low-privileged authenticated user can bypass required wr...

CVE-2026-111389

The Frappe HRMS software contains a SQL injection vulnerability in several endpoints across versions 14.x before 14.38.2 , 15.x before 15.64.0 , and 16.x before 16.18.0 . The root cause is missing input validation , which allows an authenticated attacker (including those with low-privilege accoun...

CVE-2026-25126

CVE-2026-25126: PolarLearn Vote Count Manipulation Research: Joshua van Rijswijk Description PoC for CVE-2026-25126 , a high-severity business logic vulnerability in the PolarLearn forum voting API. The endpoint POST /api/v1/forum/vote fails to enforce strict runtime validation of the direction...

CVE-2026-86849

A vulnerability exists in DPDK within the lib/vhost vhost-crypto component. The flaw is caused by an integer overflow during chain length checks combined with missing length checks on the RSA path. This issue can lead to a host buffer overflow in the vhost-crypto backend. As a mitigation, users s...

[SECURITY] [DSA 6559-1] buildstream security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6559-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 14, 2026 https://www.debian.org/security/faq -...

BIT-LIBPYTHON-2026-19553 SSLContext.wrap_bio() missing validation of server_hostname parameter

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

CVE-2026-106569

The ImageMagick image manipulation software is vulnerable to a Denial of Service (DoS) attack in its ASE decoder . Due to missing validation and resource checks, a specially crafted ASE image can cause the application to crash or trigger a long-running operation . This vulnerability affects versi...

CVE-2026-106219

JetBrains TeamCity versions prior to 2026.2.1 are vulnerable to an information disclosure issue due to insufficient validation of Git submodule URLs . This flaw allows an attacker to perform unauthorized reading of local repositories hosted on the server. To remediate this vulnerability, users sh...

EUVD-2026-93302

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

PT-2026-106646

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the neighbour subsystem where the NDTPA INTERVAL PROBE TIME MS parameter lacks proper validation because the .validation type is not set. This allows values to bypass...

EUVD-2026-76105

Headroom vulnerable to Cross-Site WebSocket Hijacking CSWSH...

PT-2026-103983

Name of the Vulnerable Software and Affected Versions Joyland AI affected versions not specified Description The application fails to validate TLS certificates from servers, allowing it to accept any certificate regardless of its authenticity. This lack of validation can enable man-in-the-middle...

Rocky Linux 10.1 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-contrib-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_3887)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263887 advisory. postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code CVE-2026-2006 postgresql: PostgreSQL intarray missing...

CVE-2026-19553

The Python ssl.SSLContext.wrap_bio() method fails to require a non-None server_hostname argument even when ssl.SSLContext.check_hostname is enabled. Due to a missing parameter check in SSLObject , omitting the server_hostname argument causes certificate hostname verification to be silently skippe...

SUSE CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

CLEANSTART-2026-CC59685 fast-uri serializes the port component of a URI without validating it

Security vulnerability affects the langfuse package. fast-uri serializes the port component of a URI without validating it...

EUVD-2026-87294

TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links...

GHSA-36F9-7RG5-CPF8 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction

Reported by @echennells Eric Chennells. Migrated from public issue 191 to a private advisory. Affected: @bsv/wallet-toolbox / -client / -mobile. Verified in 2.1.21 and 2.1.21-parity-fix.2; the relevant code is the same at current HEAD Summary: When createAction runs against a remote StorageClient...

EUVD-2026-85541

LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...

PT-2026-97526

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description Klever-Go, the Go implementation of the Klever blockchain protocol, fails to perform curve, prime-order subgroup, or nonzero validation on submitted BLSPublicKey during runtime validator...