CVE-2026-74451

A flaw was found in the drm/panthor component of the Linux kernel. The ifacefwtocpuaddr function, responsible for validating firmware interface structure sizes, does not adequately check if the firmware-provided Microcontroller Unit MCU virtual address fits entirely within the shared memory...

PT-2026-79411

Name of the Vulnerable Software and Affected Versions Omnigent versions prior to 0.3.0 Description An authenticated user with edit access to a session can replace a shared agent bundle because the system fails to reject bound shared or template agents where the agent.session id is None. By...

PT-2026-79847

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102035)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102035 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL pointer dereference on shared blocks The old-method path in fwclassify...

The vulnerability of the Coredns DNS server, related to synchronization errors when using a shared resource, allows attackers to increase their privileges.

The vulnerability of the Coredns DNS server is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

ROS-20260821-73-0012

The vulnerability of the functions rtw89coreregisterhw and rtw89pciprobe in the driver module net/wireless/realtek/rtw89/core.c of the Realtek wireless adapter driver in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102102 advisory. In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnethdr in tpacketsnd In tpacketsnd, when PACKETVNETHDR is...

ROS-20260821-73-0053

The vulnerability of the hcisuspendnotifier function in the net/bluetooth/hcicore.c file of the Linux kernel’s Bluetooth subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

CVE-2026-15743 Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

EUVD-2026-63534

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743

The Catalyst::Plugin::Static::Simple Perl module (versions through 0.38 ) contains a flaw where the _serve_static method incorrectly sets the Cache-Control header to "public" for all responses. This configuration lacks an override mechanism, even when the expires time is set to "0". Consequently,...

CVE-2026-15743 Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

JetBrains YouTrack < 2025.3.156085 / 2026.1.x < 2026.1.13913 / 2026.2.x < 2026.2.18112 Authentication Bypass (CVE-2026-75045)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.156085, 2026.1.x prior to 2026.1.13913, or 2026.2.x prior to 2026.2.18112. It is, therefore, affected by an authentication bypass vulnerability: - An unauthenticated attacker could download database backups via shar...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the PropertiesPersistingMetadataStore. An attacker can access sensitive metadata, such as processed message keys, offsets, or idempotency markers, by reading the world-readable metadata file created in ...

CVE-2026-62727

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Telephony Service allows an authorized attacker to elevate privileges locally...

CVE-2026-19506

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-19506

A race condition exists in the /usr/www2/check.jst component of the RDK-B WebUI (specifically version rdkb-2025q4-kirkstone.04.10.26). The vulnerability is caused by the use of a shared value to store password verification results; concurrent requests can lead to one user's authentication result ...

CVE-2026-19506 RDK-B WebUI race condition vulnerability

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...