PT-2026-129186

Name of the Vulnerable Software and Affected Versions @graphql-tools/executor-legacy-ws versions prior to 1.1.36 Description In the buildWSLegacyExecutor function within packages/executors/legacy-ws/src/index.ts, the executorConnectionParams object is retained in the closure scope after a...

PT-2026-129230

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early...

Ultralytics command injection vulnerability

Version 8.4.65 of Ultralytics contains a command injection vulnerability. This flaw arises because the torchsafeload function fails to perform adequate validation on user-supplied strings prior to invoking system calls; as a result, remote attackers can execute arbitrary code after users have...

OpenCATS input validation error vulnerability

Versions prior to OpenCATS 0.10.0 contain a security vulnerability. This vulnerability arises because the manageProfessional function in SettingsUI fails to properly escape input from administrators; it instead reuses the license key input as a PHP define statement within config.php. This may lea...

ROS-20261028-73-0004

The vulnerability in the sshpacketreadpoll2 function within the packet.c file of the OpenSSH cryptographic library is caused by a buffer overflow. Exploitation of this vulnerability enables a remote attacker to cause a denial of service memory read beyond bounds, application termination via...

(0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsemodel functio...

Unity Linux 20.1050a / 20.1070a Security Update: kernel (UTSA-2026-146248)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146248 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains t...

(0Day) (Pwn2Own) Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exis...

(0Day) (Pwn2Own) Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific...

PT-2026-128224

Name of the Vulnerable Software and Affected Versions Waline versions prior to 1.41.1 Description The login endpoint 'POST /api/token' reads the email field from the request body without type validation and passes it directly into a MongoDB storage query. If the email field is provided as a...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.19. It stems from improper handling by the calipsoskbuffsetattr function when adjusting payloadlen for BIG TCP packets exceeding IPV6MAXPLEN. This may lead to incorrect packet length calculations or arithmetic overflow, affecting nftables,...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.2. It arises because ntfs3 uses a custom hash and dentry comparison function under the “nocase” mount option; this leads to access to private superblock information during RCU path traversal. Since no RCU delay is applied when releasing su...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146667)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146667 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes create...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146869)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146869 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146629)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146629 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146818)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146818 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: use getunalignedbe32 in tcpsack The timestamp-only fast path dereferences...

Linux Kernel DoS

The kernel vulnerability in the Linux operating system is related to insufficient use of the assert function. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

LibRaw Heap Buffer Overflow DoS

The vulnerability in the losslessjpegloadraw function within the LibRaw image processing library is related to improper array indexing. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146639)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146639 advisory. In the Linux kernel, the following vulnerability has been resolved: ftrace: Take tracearray reference before accessing its ftraceops The trace instance files...

CVE-2026-109236: zorem Customer Email Verification for WooCommerce: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a…

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...