CVE-2026-28894

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A remote attacker may be able to cause a denial-of-service...

CVE-2026-28894

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A remote attacker may be able to cause a denial-of-service...

CVE-2025-70888

An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component...

PT-2026-35857

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.138 Description A use after free issue exists in the GPU component. This occurs when a program continues to use a pointer after it has been freed, which can lead to heap corruption. A remote attacker...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : GVfs vulnerabilities (USN-8114-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8114-1 advisory. It was discovered that the GVfs FTP backend incorrectly handled IP addresses and ports returned by passive mode responses. A maliciou...

PT-2026-27782

Name of the Vulnerable Software and Affected Versions Nanoleaf Lines versions 12.3.2 through 12.3.5 Description Nanoleaf Lines does not properly authenticate firmware file uploads. This allows a remote, unauthenticated attacker to upload firmware files to the device, potentially consuming storage...

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge browsers allows a hacker to induce a service failure.

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially created HTML page...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to trigger a service failure.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted HTML page...

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge browsers allows a hacker to induce a service failure.

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through a specially created HTML page...

Nanoleaf Lines unauthenticated firmware file store

RISK EVALUATION Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. 2. RECOMMENDED PRACTICES Update to 12.3.6. 3. DESCRIPTION Nanoleaf Lines 12.3.2 does not authenticate...

PT-2026-27797

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A flaw exists in the Lobby Ambassador web-based management API of Cisco IOS XE Software that could allow an authenticated, remote attacker to gain elevated privileges and access...

CVE-2025-70887

CVE-2025-70887 affects Ralphje Signify before v0.9.2. The issue enables privilege escalation via the signed_data.py and context.py components. Multiple sources (Red Hat, OSV, CVE lists) confirm the impact and link to a fix: update to Signify v0.9.2 or later. Public exploitation details are not pr...

The vulnerability of the pnp_alloc_dev() function in the drivers/pnp/core.c module of the Linux kernel allows a remote attacker to cause a service failure.

The vulnerability of the pnpallocdev function in the drivers/pnp/core.c module of the Linux kernel is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the Golang programming language, related to lack of access control, allows attackers to escalate their privileges.

The vulnerability of the Go programming language is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

PT-2026-27594

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.4 iPadOS versions prior to 26.4 Description The issue was addressed with improved checks. A remote attacker may cause an unexpected application termination. Recommendations Update to iOS version 26.4. Update to iPadOS...

Cisco Catalyst SD-WAN Manager XSS (cisco-sa-vmanage-xss-ZqkhP9W9)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user ...

The vulnerability of the OpenSearch software package, related to unregulated recursion, allows a hacker to trigger a service failure.

The vulnerability of the OpenSearch software package is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

CVE-2026-32948

A flaw was found in sbt, a build tool for Scala and Java. On Windows, sbt uses the cmd /c command interpreter to execute version control system VCS commands. A remote attacker can exploit this by providing a specially crafted URI fragment such as a branch, tag, or revision name in the build...

CVE-2026-4751

A flaw was found in tmate-io tmate. A remote attacker could exploit a NULL Pointer Dereference vulnerability without requiring any user interaction or special privileges. This could lead to a Denial of Service DoS condition, making the affected application unavailable to legitimate users...

CVE-2026-4775

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations,...