SUSE CVE-2026-9828

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer c...

SUSE CVE-2026-46224

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xedmabufinitobj on allocation failure When drmgpuvmresvobjectalloc fails, the pre-allocated storage bo is not freed. Add xebofreestorage before returning the error. xedmabufinitobj calls xeboinitlocked, whi...

EUVD-2026-33192

Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-44753

Name of the Vulnerable Software and Affected Versions Service Center affected versions not specified Description An Insecure Direct Object Reference IDOR issue exists in Service Center, where an authenticated remote attacker can modify a parameter within a specific query function to access EC ord...

CVE-2025-11993: Deserialization of Untrusted Data

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'importsettings' function. This is due to deserialization of untrusted data supplied via the import...

Linux Distros Unpatched Vulnerability : CVE-2026-9828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albei...

CVE-2026-40510: Stack-based Buffer Overflow

OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in pivprocesshistory in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longe...

PT-2026-44749

Name of the Vulnerable Software and Affected Versions WooCommerce Infinite Scroll and Ajax Pagination versions prior to 1.9 Description The plugin is subject to PHP Object Injection, a condition where untrusted data is deserialized, allowing an attacker to manipulate the application's logic. The...

PT-2026-44840

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.0-rc1 Description A stack buffer overflow exists in the piv process history function within src/libopensc/card-piv.c. This issue allows a physically present attacker to cause memory corruption by using a specially...

PT-2026-45062

Name of the Vulnerable Software and Affected Versions praisonai-platform affected versions not specified Description An Insecure Direct Object Reference exists in the multi-tenant deployment. The endpoint '/workspaces/workspace id/issues/issue id/activity' uses the workspace id only to verify...

PT-2026-45065

Name of the Vulnerable Software and Affected Versions praisonai-platform affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the label management functionality. The application fails to verify if the requested label or issue belongs to the workspace...

PT-2026-45058

Name of the Vulnerable Software and Affected Versions PraisonAI Platform affected versions not specified Description A systemic object-level authorization flaw exists in workspace-scoped REST routes. An authenticated user can access, modify, or delete objects belonging to another workspace by...

PT-2026-44976

Name of the Vulnerable Software and Affected Versions Rizin affected versions not specified Description A heap-buffer-overflow exists in the OMF parser within the librz/bin/format/omf/omf.c file. A heap-buffer-overflow occurs when a program writes more data to a heap-allocated memory buffer than ...

FreeBSD : mail/mailpit -- memory-exhaustion DoS via unbounded JSON body (7ae38fde-5ab6-11f1-a242-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7ae38fde-5ab6-11f1-a242-10ffe07f9334 advisory. Mailpit author reports: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on...

RockyLinux 10 : jq (RLSA-2026:19151)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19151 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON...

PT-2026-48677

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.32.0 Axios versions prior to 1.16.0 Description Axios contains two read-side prototype pollution gadgets. Prototype pollution occurs when an attacker or a dependency modifies the base Object prototype, allowing...

PT-2026-44911

Name of the Vulnerable Software and Affected Versions Axios versions 0.19.0 through 0.31.0 Axios versions 1.x through 1.15.1 Description Axios contains prototype-pollution gadgets in its request configuration processing. If a separate vulnerability in the same JavaScript process allows an attacke...

PT-2026-44985

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.14 Description A type confusion occurs when aio-prov data is stored as nni quic conn during the dialing process but is subsequently read as ex quic conn during the dialer close. This discrepancy leads to invalid...

PT-2026-45060

Name of the Vulnerable Software and Affected Versions praisonai-platform affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the dependency management endpoints. The system verifies if a user is a member of a workspace but fails to verify if the specific...

CVE-2026-46510: Improperly Controlled Modification of Object Prototype Attributes

form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys e.g. namesub into nested objects without filtering proto, constructor, or prototype. A single HTTP form field whose name starts with proto... causes the library to mutate...