PT-2026-85652

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the io uring/cmd component when an io async cmd is not recycled. The io async cmd contains an iovec array in -vec.iovec that is allocated when the vector needs to...

CVE-2026-85008: Insufficient Verification of Data Authenticity

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85214

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

CVE-2026-85182

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

CVE-2026-85214 vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

CVE-2026-85214

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

CVE-2026-85214

vhr (a Java-based HR management application) contains an authorization bypass in the PUT /hr/info endpoint. The server fails to validate that the authenticated user owns the profile ID supplied in the request body, allowing any authenticated user to overwrite arbitrary HR profiles —modifying name...

CVE-2026-85182

vhr (a Java-based HR management system) through commit 03abbd3 contains a missing authorization flaw in the PUT /hr/pass endpoint. The server fails to verify that the account ID supplied in the request belongs to the authenticated caller, enabling cross-account password changes : any authenticate...

CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

CVE-2026-85182: Authorization Bypass Through User-Controlled Key

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

PT-2026-85048

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

CVE-2026-85214: Authorization Bypass Through User-Controlled Key

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

CVE-2026-19472

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...

EUVD-2026-69062

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...

CVE-2026-19472 Rockwell Automation ArmorStart® LT Denial Of Service

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...

CVE-2026-19472

CVE-2026-19472 affects Rockwell Automation ArmorStart® LT , specifically its embedded web server . The root cause is the improper handling of a crafted HTTP PUT request , which leads to a denial-of-service condition and loss of web server availability. The vendor-assigned CVSS 4.0 score is 8.7 (H...

CVE-2026-19472 Rockwell Automation ArmorStart® LT Denial Of Service

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...

CVE-2026-19472: Allocation of Resources Without Limits or Throttling

A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability...