CVE-2026-118275: a2ui-project a2ui: A vulnerability was found in a2ui-project a2ui up to 0.10.6

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

CVE-2026-82961: zephyrproject zephyr: The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode…

The GPIO syscall handlers in drivers/gpio/gpiohandlers.c did not validate the pin argument supplied by a user-mode caller. zvrfygpiopinconfigure, zvrfygpiopingetconfig and zvrfygpiopininterruptconfigure verified only the device object KSYSCALLDRIVERGPIO / KSYSCALLOBJ and then passed the...

CVE-2026-118608: Out-of-bounds Read

Alpine iLX-F511 libanwbtstack.so prhrfcommccprocesstest Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability t...

ROS-20261028-73-0012

Multiple vulnerabilities in the session.c sshd function of the OpenSSH cryptographic library exist due to the lack of safeguards against CRLF sequence handling carriage return followed by a newline. Exploitation of these vulnerabilities enables a remote attacker to bypass command interpreter...

ROS-20261028-73-0010

The vulnerability in the authpassword function auth-passwd.c of the sshd service within OpenSSH stems from insufficient input validation mechanisms—specifically, no length restrictions are applied to authentication passwords. Exploitation of this vulnerability enables a remote attacker to cause a...

CVE-2026-118276: a2ui-project a2ui: A vulnerability was determined in a2ui-project a2ui up to 0.10.6

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

PT-2026-127859

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation...

CVE-2026-99126

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpcvalidatexid function sets grp-savedxid2-xid2flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp-savedxid2 is never...

PT-2026-129079

Name of the Vulnerable Software and Affected Versions MIME::Field::ParamVal versions prior to 5.521 Description The software fails to flag ambiguous multipart boundaries when they are written as RFC 2231 continuations. Boundary ambiguity checks only examine the plain boundary= parameter, while...

PT-2026-130563

filelock on Windows ignores the mode argument. FileLockpath, mode=0o600 creates the same file as FileLockpath: one with no security descriptor of its own the Windows record that says who may access a file. Its access list, or ACL, is whatever the lock directory hands down to new files. filelock...

PT-2026-130609

Summary The /credentials/signurl endpoint decides authorization from the client-supplied X-Rucio-Account HTTP header instead of the authenticated token's account. Any client holding any valid auth token even a low-privilege account they legitimately own can send X-Rucio-Account: root to pass the...

PT-2026-129222

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been...

ROS-20261028-73-0002

The vulnerability in the kexinputkexinit function within the OpenSSH cryptographic protection module. Exploitation of this vulnerability allows a remote attacker to cause a denial-of-service condition by sending multiple identical KEXINIT requests...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.11. It arises because after obtaining a clock via ofclkget in the wmti2cprobe function, the clock is not released using clkput during subsequent operations or module unloading. This results in a leak of clock reference counts...

VulnCheck KEV: CVE-2025-14657

The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postsettings' function in all versions up to, and including, 4.0.51. This makes it possible for...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.19. It arises when a failure in setting up mqueue or ipc sysctl leads to the use of the regular mntput function to unmount a long-lived mount, resulting in leaks of the mount and mqueue superblocks...

WordPress Event Booking Manager for WooCommerce permission and access control issue vulnerability

WordPress Event Booking Manager for WooCommerce versions 5.7.8 and earlier contain a vulnerability related to permission escalation and access control. This issue arises because the userhascap hook in the mepgrantshopmanageraccess function grants manageoptions privileges unconditionally whenever...

Alpine iLX-F511 buffer error vulnerability

The Alpine iLX-F511 running version 7.0.000 contains a buffer error vulnerability. This vulnerability arises because the prhsdpservicesearchdecode function fails to properly validate the length of user-supplied data prior to copying it into the stack buffer. As a result, network-adjacent attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-99126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/ctcm: Prevent XID null dereference The mpcvalidatexid function sets grp-savedxid2-xid2flag2 to 0x40 to signal XID validation error. If peer XID is NULL or...

Linux Distros Unpatched Vulnerability : CVE-2026-99138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With...