PT-2026-62666

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3 Description An issue exists in the Installation Security component that allows an unauthenticated attacker with access to the physical communication segment attached to the hardware to...

PT-2026-63315

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Three code paths bypass the existing Server-Side Request Forgery SSRF protections by using raw http.Get instead of the validated hostmatcher.NewDialContext dialer. This allows an attacker to ma...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2740)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the exsltFuncResultComp function of libxslt, which handles EXSLT func:result elements during stylesheet parsing. Due to...

ROS-20260721-73-0047

The vulnerability of the AdFilter component in Google Chrome and Microsoft Edge relates to reading data beyond the permitted range in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page from a remote location...

EulerOS Virtualization 2.10.0 : libpng (EulerOS-SA-2026-2857)

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image...

EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2026-2854)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : mrp: introduce active flags to prevent UAF when applicant uninitCVE-2022-50697 net: skbuff: propagate shared-frag marker through...

CVE-2026-55238

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...

CVE-2026-55238 xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...

CVE-2026-46701

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret process.env'NETWORKAIMCPSECRET' ?? '' at bin/mcp-server.ts:89, which causes isAuthorized lib/mcp-transport-sse.ts:254 to return true unconditionally for every reques...

urllib3: urllib3: Denial of Service due to excessive HTTP response decompression

A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response,...

PT-2026-61653

Name of the Vulnerable Software and Affected Versions WhatsApp MCP Server versions prior to 0.2.1 Description The whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication or Host header validation. Additionally, the /api/send endpoint accepts an absolute media path parameter...

Linux Distros Unpatched Vulnerability : CVE-2026-63902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format...

PT-2026-61674

The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...

EUVD-2026-45654

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-64069

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream-subrequests list, it can't simply be put and abandoned...

CVE-2026-64064 netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsinvalidatefolio to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfsfolio struct hung off of folio-privat...

CVE-2026-64062 netfs: Fix potential deadlock in write-through mode

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfsadvancewritethrough to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until t...

CVE-2026-64062

CVE-2026-64062 is a deadlock in the Linux kernel's netfs (network file systems library) subsystem, specifically in netfs_advance_writethrough(). In write-through mode , the function could fail to unlock the supplied folio before marking it dirty, leading to a deadlock against mmapped reads and wr...

CVE-2026-63857

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airohadevxmit The transmit loop in airohadevxmit reads fragment address and length during its final iteration, when the loop index equals skbshinfoskb-nrfrags, at which...

CVE-2026-64014

The CVE-2026-64014 issue affects the Linux kernel USB touchscreen path for NEXIO devices (nexio_read_data). It describes a vulnerability where data_len and x_len are read from a 16-bit header and used to walk packet data without proper bounds, potentially enabling a ~64 KiB out-of-bounds read pas...