PT-2026-109925

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can read any AI prompt template due to missing authorization in the queryById handler of the AiragPromptsController. An attacker can use the unguarded...

PT-2026-109915

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the OssFileController. Low-privileged authenticated users can access object storage file records by sending a request to the 'GET...

PT-2026-109910

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Authenticated users can read the role codes of any user due to missing authorization in the queryUserRolesById handler of the SystemApiController. Low-privileged attackers can exploit this by sendi...

PT-2026-109673

Name of the Vulnerable Software and Affected Versions GenOffice versions prior to 0.11.506 Description An incorrect permissions issue exists in the HTTP MCP server file store. Local unprivileged users can access the world-readable genoffice-mcp-http directory located within the system temporary...

Linux Distros Unpatched Vulnerability : CVE-2026-106428

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...

Linux Distros Unpatched Vulnerability : CVE-2026-107817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin...

PT-2026-109616

Name of the Vulnerable Software and Affected Versions Divi Plus versions prior to 2.4.1 Description The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function SVGAnimatorController::index permissi...

Linux Distros Unpatched Vulnerability : CVE-2026-98375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xen/netfront: drop RX packets with a short Ethernet header handleincomingqueue pulls pullto bytes into the head before calling ethtypetrans. pullto is the lengt...

PT-2026-109911

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the getUserPermissionSet handler of the SystemApiController. This issue allows an authenticated user with low privileges to retrieve the complete permission set of a...

Linux Distros Unpatched Vulnerability : CVE-2026-98384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to...

PT-2026-109518

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.6 Description The plugin fails to confine media-import file copies to the document root and does not enforce effective file-type restrictions. This allows users with the Author role or higher to plant...

CVE-2026-103635: Out-of-bounds Read

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. compactthetasketch::deserialize and wrappedcompactthetasketch::wrap read header fields before checking that the input was long enough. For the compressed format, the size check could ...

CVE-2026-103636: Out-of-bounds Read

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ repo: datasketches-cpp. varoptunion::deserialize read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes...

CVE-2026-107373: Out-of-bounds Read

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl TSTDSTRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string SvPVnolen$arg, SvCUR$arg However, evaluation order for C++ arguments is not specified, and some compilers may produce code...

PT-2026-109749

Name of the Vulnerable Software and Affected Versions Tabularis versions prior to 0.27.1 Description An incorrect authorization issue exists in the MCP run query safety gate. This allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT...

PT-2026-109737

Name of the Vulnerable Software and Affected Versions OpenLIT version 2.1.0 Description An authorization bypass allows authenticated users to access telemetry from other projects. By providing a forged x-openlit-project-id header and knowing a victim's project ID and database configuration ID, an...

CVE-2026-91136: Improper Limitation of a Pathname to a Restricted Directory

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

CVE-2026-108654: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-108650: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...