Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. In affected versions of Werkzeug, the debugger can allow an attacker to execute code on a developer’s machine under certain circumstances. This requires the attacker to get the developer to interact with a domain and subdomain that they...

Astra Linux – Vulnerability in opensc

A flaw was discovered in OpenSC packages that could allow for a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length PIN is passed. This issue poses a security risk, especially for OS...

CVE-2026-89475: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

PT-2026-90207

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Three related issues exist in the o2hb region pin function within the ocfs2 cluster component. First, the function is called while holding the o2hb live lock spinlock, but it invokes...

EUVD-2026-66331

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

CVE-2026-19723 Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

CVE-2026-19723 Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons WordPress plugin versions before 3.0.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly escape a value from an incoming request before outputting it into an inline JavaScript event ha...

CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51626

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

SUSE CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-80648 pinctrl: spacemit: fix NULL check in spacemit_pin_set_config

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-80648 pinctrl: spacemit: fix NULL check in spacemit_pin_set_config

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

PT-2026-83193

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-82948

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the spacemit pin set config function where the code performs a NULL check on the wrong variable. The function uses spacemit get pin to retrieve a per-pin descriptor bu...

CVE-2026-51628: Improper Access Control

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control issue in the getGenerateWiFiWpsPin function. An unauthenticated attacker can generate and retrieve a new WPS PIN by sending a crafted POST request to /cgi-bin/cstecgi.cgi. While t...

EUVD-2026-67896

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...