EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098810)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098810 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CTPTPNUM from 1 to 4 to...

Linux Distros Unpatched Vulnerability : CVE-2026-79776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can...

Linux Distros Unpatched Vulnerability : CVE-2026-79089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-79781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in ...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031329 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrar...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098881)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098881 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher requests Do not access random memory for...

Linux Distros Unpatched Vulnerability : CVE-2026-78959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass...

PT-2026-82223

Name of the Vulnerable Software and Affected Versions Midday affected versions not specified Description An authorization flaw exists in the team management logic where the system fails to verify the user role during team deletion and updates. The delete procedure in the...

PT-2026-82334

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.1 Description Cluster-scoped APIs do not consistently validate per-cluster access. This allows an authenticated user with cluster management permissions to operate on clusters outside their granted scope. Because t...

PT-2026-81945

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

PT-2026-82333

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.0 Description SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, allowing SSO, OIDC, and SAML management operations to be accessed without...

PT-2026-82256

Name of the Vulnerable Software and Affected Versions Dell Cloud Disaster Recovery versions prior to 20.3 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could exploit this fla...

PT-2026-82100

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An improper authorization check allows an authenticated user with reporter-role permissions who authored a merge...

VulnCheck KEV: CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

CVE-2023-42179

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control through its key derivation process and password validation process. This could allow unauthorized parties to gain access to the device by exploiting weaknesses in how keys are derived or passwords are validated. N...

EUVD-2023-60608

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process...

CVE-2026-26447

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap...