PT-2026-70065

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

CVE-2026-14548: Missing Authorization

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-72761

The CVE affects the webhook URL validator in website/notifications/webhooks.py, which uses ip.is_global after DNS resolution. IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32) are categorized as globally routable by IANA, causing is_global to return True even w...

EUVD-2026-55474

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes through a hotplug cycle online-offline-online, and the vCPU then resume...

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and doe...

PYSEC-2026-3645 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Remove the reference to the translation cache only for the erased entry. The vgicitsinvalidatecache function iterates through the per-ITS translation cache using xaforeach, and removes the cache reference fo...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

PT-2026-69494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM SVM implementation where a virtual CPU vCPU may use an Address Space Identifier ASID already assigned to another vCPU after a physical CPU pCPU hotplug cycle...

penetration-testing-windows10

Vulnerability Analysis and Penetration Testing Using Metasploi...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

Security Bulletin:Vulnerability in grub affects IBM Netezza Appliance

Summary The grub package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2024-45777 Vulnerability Details CVEID:CVE-2024-45777 DESCRIPTION: A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Entra ID researcherDirk-jan Mollema demonstrated that malware already running in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Microsoft Entra ID. The attacker can then establish longer-term cloud access, register a device it controls,...

EUVD-2026-54194

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447

CVE-2026-71447 : In the AIL Project (ail-framework), translation controls for chat messages and forum posts store identifiers into inline JavaScript onclick handlers without safe encoding for JS string literals. Although escaping is applied for HTML, the values can terminate the string argument, ...