CVE-2026-113352

Versions of uTox through 0.18.1 are vulnerable to a path traversal vulnerability (CWE-22) during auto-accepted file transfers. If a user has auto-accept enabled, an attacker can send absolute or ../ filenames to write arbitrary files. This allows attackers to overwrite shell startup files or plan...

PT-2026-118336

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft find resumeable loads...

CVE-2026-111902

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read...

CVE-2026-111902 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read...

CVE-2026-111902

The phpMyFAQ software (versions 4.2.0-alpha before 4.2.0-beta ) is vulnerable to an authorization bypass in the isFaqAccessibleForUser() function. The root cause is that the system incorrectly treats missing FAQ translations as visible to unauthenticated users. By sending a mismatched Accept-Lang...

CVE-2026-111902 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read...

CVE-2026-111902: Authorization Bypass Through User-Controlled Key

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read...

PT-2026-116472

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta Description An authorization bypass exists in the isFaqAccessibleForUser function, which incorrectly treats missing FAQ translations as visible to unauthenticated users. By sending a mismatched...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, as well as 10.0.0 and 11.0.0, when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e., q parameters, the server may enter a Denial-of-Service DoS state due to high CPU usage in processing...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tcp: Call skdataready after listener migration When inetcsklistenstop migrates an established child socket from a closing listener to another socket within the same SOREUSEPORT group, the target listener receives a new...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: TCP: Make sure to lock the acceptqueue’s spinlocks once. When I run SyZ’s reproduction C program locally, it causes the following issue: pvqspinlock: Lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19; PID: 21160;...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: e1000: fixed an out-of-bounds error in e1000tbishouldaccept In e1000tbishouldaccept, we read the last byte of the frame via “datalength - 1” to evaluate the TBI workaround. If the descriptor’s reported length is zero or greater...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A issue was discovered in the Linux kernel before version 6.6.8. The roseioctl function in net/rose/afrose.c has a use-after-free issue due to a race condition involving roseaccept...

CVE-2026-105990

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...

CVE-2026-105989 Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

CVE-2026-105990

The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions prior to 4.0.7 , is vulnerable to an unauthenticated PII disclosure . The root cause is a lack of authorization checks when exporting stored form submissions. This flaw allows unauthenticated attackers to download sensi...

CVE-2026-105990 Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data name, email, telephone, postal address, message and payment metadata o...

CVE-2026-105989

The Accept PayPal Payments using Contact Form 7 WordPress plugin, in versions before 4.0.7 , is vulnerable to unauthenticated transaction status forgery. The root cause is a lack of authorization and request-validation checks on one of its AJAX actions. This allows an unauthenticated attacker to ...

CVE-2026-105989: Missing Authorization

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

Inefficient Algorithmic Complexity

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to quadratic-time parsing in django.utils.http.parseheaderparameters within...