CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

EUVD-2026-56233

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

CVE-2026-66484

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

Windows HTTP.sys Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-68326

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. A malicious or malfunctioning mwifiex device, operating in Access Point AP or micro-AP uAP mode, can provide a crafted event with an invalid length value. This unchecked length can lead to an out-of-bounds read or integer underflow,...

CVE-2026-72559

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

CVE-2026-72559 Daniel Brendel HortusFox - Cross-Site Scripting

A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views the affected plant. An attacker can us...

Security Bulletin: Vulnerability in OpenSSL affects IBM Netezza Appliance

Summary The OpenSSL package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-28386 Vulnerability Details CVEID:CVE-2026-28386 DESCRIPTION: Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES suppo...

drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference

...

PT-2026-70283

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software for Windows affected versions not specified Description A null pointer dereference within Ring 0 the most privileged level of the CPU of the kernel may lead to a denial of service. An unprivileged,...

PT-2026-70502

Name of the Vulnerable Software and Affected Versions Windows HTTP.sys affected versions not specified Description An integer underflow wrap or wraparound occurs in Windows HTTP.sys, which is the kernel-mode driver that handles HTTP requests. This flaw allows an authorized attacker to elevate...

CVE-2026-66098: Missing Authentication for Critical Function

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-73083: Protection Mechanism Failure

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

PT-2026-76018

When the trusted proxies option is configured, heimdall extracts client IP addresses from the Forwarded and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary...

CVE-2026-62721: Insufficient Granularity of Access Control

Insufficient granularity of access control in User-Mode Power Service UMPS allows an authorized attacker to elevate privileges locally...

gitea -- Multiple vulnerabilities

Gitea reports This release addresses the following security vulnerabilities. Please upgrade as soon as possible. Unauthenticated arbitrary file read via the Org-mode INCLUDE directive. Remote code execution via the diffpatch API through Git hook installation...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...