CVE-2026-63996: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

PT-2026-61395

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter x tables component where the removal of a table via rmmod prevents userspace from re-instantiating the table during set/getsockopt operations. This occur...

CVE-2026-16214: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and...

CVE-2026-16205: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialcharsdecode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible ...

PT-2026-61048

A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and...

PT-2026-61039

Name of the Vulnerable Software and Affected Versions Pluck CMS versions prior to 4.7.22 Description In the Albums Module, the htmlspecialchars decode function within the data/modules/albums/albums.admin.php file contains a flaw. A remote attacker can manipulate the Info argument to execute...

CVE-2026-64076: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: ebtables: close module init race sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nfregistersockopt completes, the sockopts are exposed...

Linux Distros Unpatched Vulnerability : CVE-2026-53386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pgasettings index ads1298pgasettings has 7 element...

CVE-2026-63995: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

MGASA-2026-0263 Updated perl-Config-IniFiles package fixes a security vulnerability

The updated package fixes a security vulnerability: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle. CVE-2026-11527...

Updated perl-HTML-Parser packages fix security vulnerability

HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. CVE-2026-8829...

CVE-2026-16128 zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiverthread of the file claw/services/swarm/swarm.c of the component httprequest. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The...

CVE-2025-71391

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instan...

MAL-2026-10916 Malicious code in python-devplatform-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8daa66fc6fa92869318e5a544d82fab2d5dff870dc4c6784f28733f84441415a The package's setup.py copies a telemetry.pth file into site-packages so every Python interpreter startup on the host auto-imports telemetryinit, whi...

CVE-2025-71391

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instan...

CVE-2025-71391 SurrealDB before 2.2.2 Denial of Service via /sql endpoint

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instan...

CVE-2025-71391: Uncaught Exception

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instan...

AZL-92450 CVE-2026-56740 affecting package jline 2.14.6-1

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables in TelnetIO.java:1127-1180...

EUVD-2026-45327

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

GO-2026-5973 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...