The vulnerability of the l2cap_ecred_conn_req() function in the net/bluetooth/l2cap_core.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to access protected information or cause service failures.

The vulnerability of the l2capecredconnreq function in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to gain access to protected...

The vulnerability of the simplify_symbols() function in the kernel/module/main.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the simplifysymbols function in the kernel/module/main.c module of the Linux operating system is related to the improper checking of the specified index, position, or offset in the input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the i2c_s3cirq_nextbyte() function in the drivers/i2c/busses/i2c-s3c2410.c file of the I2C driver for the Linux operating system’s hardware layer allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the i2cs3cirqnextbyte function in the driver/i2c/busses/i2c-s3c2410.c file of the I2C hardware layer of the Linux operating system is related to the issue of writing operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to compromis...

PT-2026-81722

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incorrect authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user to...

PT-2026-81877

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.42 through 9.0.120 Description A Time-of-check Time-of-use TOCTOU Race Condition occurs when creating unix domain...

PT-2026-81786

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper privilege management in Regional Capabilities allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to induce the...

PT-2026-81773

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Incorrect authorization in WebAppInstalls allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome on...

Gitea Code Injection Vulnerability

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...

CVE-2026-78266

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-32563

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32561

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-27364

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-32559

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...

SUSE-SU-2026:3770-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.37 fixes various security issues: The following security issues were fixed: - CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024. -...

CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-78266

AutomatorWP , a WordPress plugin , is affected by a Broken Access Control vulnerability in versions ≤ 5.8.3 . The flaw allows a Subscriber -level authenticated user to perform actions beyond their expected permissions, resulting in a high integrity impact (CVSS 3.1 base score 6.5 / MEDIUM ). The ...

CVE-2026-78264

CVE-2026-78264 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Toolset Blocks plugin in versions 1.6.26 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 base score of 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-explo...

CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...