CVE-2026-80114

PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) share a hard-coded credentials vulnerability in the shared driver DirectIo64.sys . An 8-byte key embedded as a hardcoded literal in the distributed binary allows local ...

EUVD-2026-71685

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

CVE-2026-80114 PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

CVE-2026-85626 git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-85626

git-mcp-server 2.15.1 is affected by an argument injection vulnerability in the ref and object parameters of the git_log, git_diff, and git_show tools. The root cause is a lack of leading-dash validation , allowing attackers to inject git command-line options such as --output= and write files out...

EUVD-2026-70812

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...

CVE-2026-85091

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gzvacate function when processing non-blocking gzwrite operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf or gzvprintf after a write stall, causing an...

CVE-2026-85428

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...

EUVD-2026-58627

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification publish mode...

CVE-2026-78596

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

EUVD-2026-70660

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

PT-2026-85214

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

EUVD-2026-69724

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

CVE-2026-84482 WWBN AVideo Cross-Site Request Forgery via get_domain() validation

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

CVE-2026-84482

WWBN AVideo (through commit 9c39d8c8) contains a cross-site request forgery (CSRF) vulnerability in the get_domain() and isSameDomain() functions, which fail to properly validate referer origins. An attacker can forge requests from sibling subdomains or unparseable long-gTLD origins to perform ad...

PT-2026-84541

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8 Description Cross-site request forgery occurs because the get domain and isSameDomain functions fail to properly validate referer origins. This allows attackers to forge requests from sibling subdomains...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

CVE-2026-80706

In the Linux kernel, the following vulnerability has been resolved: can: softing: fwparse: validate firmware record spans fwparse reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make...

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended...