CVE-2026-32823 dataCycle State-Changing GET Endpoints Enable CSRF

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-32823 dataCycle State-Changing GET Endpoints Enable CSRF

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-53378

A flaw was found in the Linux kernel's Direct Rendering Manager DRM color operation module drm/colorop. This vulnerability arises from improper reference tracking of blob properties during state duplication, destruction, and reset operations. An attacker with local access could potentially exploi...

CVE-2026-63753

SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes...

CVE-2026-10755 All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

EUVD-2026-45878

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

PT-2026-61691

Name of the Vulnerable Software and Affected Versions cal.diy versions 6.2.0 and earlier Description An open redirect issue exists in the conferencing OAuth callback endpoint. Attackers can redirect users to arbitrary URLs by crafting malicious state parameters, specifically exploiting the unsign...

CVE-2026-32823: Cross-Site Request Forgery (CSRF)

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

Russian State Actors Are Compromising IP Cameras in Europe for Military Purposes

Intelligence from the Netherlands General Intelligence and Security Service AIVD and the Netherlands Defence Intelligence and Security Service MIVD - the Dutch services - illustrates that Russian state actors are systematically conducting digital espionage operations via IP cameras cameras with...

Linux Distros Unpatched Vulnerability : CVE-2026-64090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs added checks to th...

CVE-2026-10755: Incorrect Authorization

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

PT-2026-61521

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?

Self-hosted AI agents read and write their own memory and configuration files to function. An agent may get compromised via corruption of its own state -- a compromise realized via legitimate OS system call invocation. We refer to this class of threats as self-state attacks. In this paper, we...

CVE-2026-63768: URL Redirection to Untrusted Site

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-64205: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...

Linux Distros Unpatched Vulnerability : CVE-2026-63972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When...

Linux Distros Unpatched Vulnerability : CVE-2026-63911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfsclonestate clones the IPTFS mode data...

Linux Distros Unpatched Vulnerability : CVE-2026-63937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when readin...

Linux Distros Unpatched Vulnerability : CVE-2026-53378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/colorop: Fix blob property reference tracking in state lifecycle The colorop state blob...