Linux Distros Unpatched Vulnerability : CVE-2026-82388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by...

CVE-2026-109236: zorem Customer Email Verification for WooCommerce: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a…

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...

DALIBO PostgreSQL Anonymizer resource management error vulnerability

Versions prior to DALIBO PostgreSQL Anonymizer 3.3.0 contain a resource management error vulnerability. This vulnerability arises because the anon.imageblur function fails to validate the declared size of provided images. Attackers can supply small images with excessively large declared sizes,...

CVE-2026-61542: Missing Authentication for Critical Function

Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional --mcp-http mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and...

PT-2026-129231

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/ vtk 42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project...

PT-2026-127803

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb shortcode handler function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch...

PT-2026-127804

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web core/src/v0 9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

PT-2026-127735

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web core/src/v0 9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...

PT-2026-127812

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the...

PT-2026-128100

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs attr record resize ntfs new attr flags passes the wrong MFT record to ntfs attr record resize. When the attribute is in an extent record, ctx-mrec points to the extent but the...

PT-2026-128116

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.224 Description An issue exists in the virtio transport recv pkt function where the fallback mechanism for looking up sockets in the bound table fails to validate the source address. This allows a response...

PT-2026-128118

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perf event throttle -- PMU-stop Shortly later t...

PT-2026-128124

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.191 Linux kernel versions prior to 6.6.161 Description A quota enforcement bypass exists in the XFS file system. A user can evade group quota limits and exceed the hard limit by changing a file's group ID to...

PT-2026-128136

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.161 Description An out-of-bounds memory access issue exists in the tracing predicate parser. The predicate parse function incorrectly uses an increased value to reserve terminal TRUE and FALSE entries as the...

PT-2026-127862

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

PT-2026-128328

Ultralytics check det dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

PT-2026-128327

Ultralytics torch load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a...

PT-2026-128321

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The...

PT-2026-128331

Ultralytics load dataset cache file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target...

PT-2026-128342

Name of the Vulnerable Software and Affected Versions HTTP::Body versions prior to 1.23 01 Description CPU exhaustion can occur when parsing chunked request bodies. In chunked mode, which is utilized when no content length is provided, the add function matches each chunk-size line using a regular...