CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-96283 Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

CVE-2026-96283 Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

CVE-2026-96283

The Flatpak software suite is affected by a cross-user vulnerability where calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull operation removes it from internal tracking without actually cancelling the action. This results in orphaned pulls that the owning user cannot ...

CVE-2026-96281

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious...

CVE-2026-96281

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious...

CVE-2026-96281

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious...

CVE-2026-96281 Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious...

EUVD-2026-88027

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious...

CVE-2026-36213-poc

CVE-2026-36213：MEmu Android 模拟器 9.2.7.0 本地权限提升 https://img.shields.io/badge/platform-Windows-blue https://img.shields.io/badge/CVE-2026--36213-red https://img.shields.io/badge/EDB--ID-52615-orange 概述 本仓库包含针对 CVE-2026-36213 的 Python 概念验证（PoC），这是 Windows 上 MEmu Android 模拟器 9.2.7.0 中的一个本地权限提升漏洞。 该漏洞...

Exploit for Unrestricted Upload of File with Dangerous Type in Zohocorp Manageengine_Applications_Manager

CVE-2020-14008 — ManageEngine Applications Manager Remote Code...

CVE-2026-86841

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86839

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

EUVD-2026-87890

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

EUVD-2026-87891

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

MiracleLinux 8 : kernel-4.18.0-553.163.1.el8_10 (AXSA:2026-1919:84)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1919:84 advisory. kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address...

Evaluating System One Models for Agent Security Decisions: Reliability, Calibration, and Selective Automation

Model-based judges support agent security by detecting prompt injections, assessing interaction risks, and screening harmful requests. System One models expose typed decisions with probabilities that software can use to allow, block, or escalate inputs, but whether these probabilities support...

PT-2026-99728

Name of the Vulnerable Software and Affected Versions amirsanni Mini-Inventory-and-Sales-Management-System versions up to 81bf0b55f5933f3b0dbb1583204a612e06605b95 Description A security flaw in the Database Query Builder component allows remote exploitation via SQL injection. The issue occurs whe...

PT-2026-99545

Name of the Vulnerable Software and Affected Versions TOTOLINK N150RT version 3.4.0-B20201030 Description The Web Management Interface contains a flaw in the /boafrm/formWlSiteSurvey endpoint. Specifically, the system function fails to properly sanitize the wlanif argument, allowing a remote...

PT-2026-99723

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A flaw exists in the flatpak-system-helper where calling the org.freedesktop.Flatpak.SystemHelper.CancelPull endpoint on a pull belonging to another user fails to actually cancel the operatio...