CVE-2026-99067

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

CVE-2026-116195

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a sour...

PT-2026-123410

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgradin...

PT-2026-125484

Name of the Vulnerable Software and Affected Versions libpff versions prior to 20260927 Description An off-by-one bounds check in the libpff table read 6c record entries function allows for a heap out-of-bounds read. This occurs when the software processes specially crafted 6c table record entrie...

PT-2026-125535

A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may ...

PT-2026-123419

bt hfp hf connect in subsys/bluetooth/host/classic/hfp hf.c allocates the per-connection HFP Hands-Free object with hfp hf create, which starts an SDP discovery by passing the object's embedded hf-sdp param to bt sdp discover. That call links the caller-owned parameter block into the SDP client's...

PT-2026-125038

A vulnerability was determined in Omega Solution Restro POS up to 20261026. This impacts an unknown function of the file /sale-invoice/. Executing a manipulation of the argument productUnitSalePrice can lead to business logic errors. The attack may be performed from remote. The exploit has been...

PT-2026-123332

A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local...

PT-2026-123333

A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be...

PT-2026-123329

A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit ha...

PT-2026-123330

A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve class name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attac...

PT-2026-123331

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may ...

PT-2026-125382

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268 B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched...

PT-2026-125383

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268 B20221104. Affected is the function apmib set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...

Linux Distros Unpatched Vulnerability : CVE-2026-116124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function oleinforeadmetabat of the file...

PT-2026-123194

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing authentication. The attack is only possible with local...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792689093)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792689093 advisory. - A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in...

Linux Distros Unpatched Vulnerability : CVE-2026-116260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function servicereceive of the file src/afc.c of the component AFC Servic...

PT-2026-123290

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

PT-2026-123155

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...