PT-2026-77179

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when t...

pcp security update

7.0.3-5.0.1 - Fix unterminated backtick in pmloggerjanitor fix not to terminate unauthorized process patch Orabug: 39270658 - Adds interval option support in PCP nfsiostat tool Orabug: 39068870 - Introduces proc.numamaps metrics in linuxproc PMDA Orabug: 39096683 - adds numastat process option in...

PT-2026-76966

Name of the Vulnerable Software and Affected Versions Citrix WorkSpace App version 2607 Description An issue exists in Citrix WorkSpace App on MacOS that allows external control of a file name or path. This occurs when the application does not properly validate the file path provided by an extern...

PT-2026-77270

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequested path, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

PT-2026-77317

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom components/blueprint studio/backend/terminal manager.py accepted a cwd working-directory parameter and checked only whether the...

PT-2026-78237

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0 Description The perform-scheduled-backup IPC handler in src/ipc/storage.js fails to verify if the settings.path provided by a renderer-supplied object is within an authorized backup location. This allows a...

Linux Distros Unpatched Vulnerability : CVE-2026-72224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on some error paths in bttinit. This leaks...

Linux Distros Unpatched Vulnerability : CVE-2026-72270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: s3fb: fix potential memory leak in s3pciprobe In s3pciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent err...

Linux Distros Unpatched Vulnerability : CVE-2026-74367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: ...

Linux Distros Unpatched Vulnerability : CVE-2026-74395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by th...

Amazon Linux 2023 : spice-vdagent (ALAS2023-2026-2061)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2061 advisory. A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-15059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. CVE-2026-15059 Note that...

PT-2026-77165

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description The image analyze tool fails to canonicalize symlinks before reading files, leading to a path traversal issue. This allows attackers to create workspace symlinks that point to external files with...

PT-2026-78235

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.5.0 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The downloadSubtitleFile function in src/ipc/downloads.js, accessed via the run-download IPC...

Linux Distros Unpatched Vulnerability : CVE-2026-72196

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetv...

PT-2026-77243

MobSF is a mobile application security testing tool used. Prior to 4.5.1, find icon path zip in mobsf/StaticAnalyzer/views/android/icon analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containmen...

PT-2026-78232

Name of the Vulnerable Software and Affected Versions Confidential Containers Guest Components versions 0.16.0 through 0.19.0 Description A crafted OCI image layer can cause the image rs::stream::unpack::unpack function to create a hardlink outside its intended destination directory. This occurs...

PT-2026-77251

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Description An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate...

PT-2026-77168

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description The HTTPPasswordMgr class in the urllib.request module, including its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, fails to consider the URL scheme when matchin...

Linux Distros Unpatched Vulnerability : CVE-2026-73646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18,...