PT-2026-82066

Name of the Vulnerable Software and Affected Versions TarsWeb affected versions not specified Description Improper authorization occurs because four methods in app/controller/patch/PatchController.js fail to call the AuthService to enforce per-application roles. This allows any authenticated user...

Linux Distros Unpatched Vulnerability : CVE-2026-79015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted...

PT-2026-81948

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

PT-2026-82096

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An issue exists where an authenticated user with developer-role permissions can influence the execution environmen...

PT-2026-82095

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.10 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 Description An authenticated user can cause a denial of service through an unbounded loop. This occurs when specially crafted input is...

VulnCheck KEV: CVE-2026-49869

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath.endsWith"/configs" to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match...

Linux Distros Unpatched Vulnerability : CVE-2026-79226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2026-75325

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

PT-2026-82056

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a network-connected actor to perform command injection on the host device. Command injection is a flaw where an attacker can execut...

PT-2026-82179

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the sloppy-logic-analyzer component of the Linux kernel. The trigger write function dereferences the gpio la poll priv object without taking a debugfs...

PT-2026-82297

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via...

PT-2026-82324

Name of the Vulnerable Software and Affected Versions SeaweedFS versions 3.88 through 4.39 Description The SFTP server evaluates configured path permissions using a literal string-prefix comparison instead of requiring a path-component boundary. This allows an authenticated low-privilege user...

CVE-2026-75415

AntFlow V2.0.0 suffers from an Incorrect Access Control flaw in the file JiMuMDCCommonsRequestLoggingFilter.java . This component retrieves the userid from the request header and uses it as the core identity verification mechanism . Because the header value is not independently validated, an atta...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

PT-2026-82228

Name of the Vulnerable Software and Affected Versions Bird Home Automation GmbH D1101V-F 000140 affected versions not specified Description Incorrect access control exists due to flaws in the key derivation process and the password validation process. Recommendations At the moment, there is no...

CVE-2026-26447

Stomper (commit 5e2741e ) contains a heap use-after-free vulnerability in its STOMP broker's subscription management. When a single client repeatedly sends SUBSCRIBE commands for the same destination and then disconnects, the broker incorrectly cleans up its internal subscription structures. The ...

Linux Distros Unpatched Vulnerability : CVE-2026-79177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to...

Linux Distros Unpatched Vulnerability : CVE-2026-34964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for...

Linux Distros Unpatched Vulnerability : CVE-2026-74737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is...