Linux Distros Unpatched Vulnerability : CVE-2026-68358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: nzxt-kraken3 Stop device IO before calling hidhwstop Calling hidhwstop does not stop the device IO. This results in a race condition between hidinputrepo...

PT-2026-70888

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete revision function in all versions up to, and including, 2.8.169. This makes it possible for...

PT-2026-70259

Name of the Vulnerable Software and Affected Versions Zoom Clients affected versions not specified Description A missing bounds check in the annotator function allows a buffer over-write. This issue occurs due to a 32-bit width x height overflow in a native video receive worker. A meeting...

VulnCheck KEV: CVE-2026-68820

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

PT-2026-70845

A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss ogs diam s6a air cb/hss ogs diam s6a ulr cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is...

PT-2026-70942

A vulnerability was determined in Open5GS up to 2.7.1. This vulnerability affects the function mme s6a subscription data from avp of the file src/mme/mme-fd-path.c of the component Diameter S6a Interface. Executing a manipulation of the argument msisdn len can lead to heap-based buffer overflow. ...

KLA91207 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products ESU. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, perform cross-site scripting attack, spoof user...

Security Updates for Microsoft SharePoint Server Subscription Edition (August 2026)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale System monitoring layer are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale System monitoring layer and could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.9 or higher and 6.0.1.1 or higher Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Cloud installation tool (cloudkit) are now fixed in 5.2.3.8 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the cloud deployment installation tool cloudkit could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.8 or higher and 6.0.1.1. Vulnerability Details CVEID:CVE-2026-29181 DESCRIPTION:...

Malicious code in @dreamguyxeon/baileyx (npm)

npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches...

MAL-2026-13930 Malicious code in @dreamguyxeon/baileyx (npm)

npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches...

CVE-2026-68083

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB server. An authenticated client could exploit a path resolution error, specifically in the ksmbdvfskernpathcreate function. This vulnerability allows a client to use ".." components in a path to escape the intended...

Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

MAL-2026-13712 Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

DEBIAN-CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-72906

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated...

CVE-2026-72907

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...