CVE-2026-54642: Cross-Site Request Forgery (CSRF)

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

PT-2026-95153

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists where the file 'admin/sources/products.index.inc.php' reads rich-text fields from the $GLOBALS'RAW''POST' variable and only removes script elements before storing and rendering them...

CVE-2026-54643: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

PT-2026-95051

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

Geomap MapLibre XSS

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

CVE-2026-54648: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

PT-2026-94423

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fq codel init function where the q-quantum and q-cparams.mtu values are set using psched mtu without proper clamping. When a device is configured with an excessive...

PT-2026-95156

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An authorization bypass exists in the GDPR tools located in the admin/sources/customers.gdpr.inc.php file. The system relies on page-level CC PERM READ access and fails to require CC PERM DELETE for...

PT-2026-94421

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the net/sched component when handling the quantum value. The hhf init function sets q-quantum using psched mtu without an overflow check. On devices with an...

CVE-2026-90229: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

PT-2026-95103

Name of the Vulnerable Software and Affected Versions Speakr versions prior to 0.8.21-alpha Description An issue exists where the csrf exempt for api tokens before request hook in src/app.py calls csrf.exemptview func, which permanently adds the selected view to the process-global exemption set o...

PT-2026-94424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fq init function where quantum and initial quantum are computed using psched mtu without overflow checks. When a device has an excessively large Maximum Transmissi...

PT-2026-95090

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.1 Description An authentication bypass exists where the endpoint "POST /api/auth/passkeys" accepts a userId and a passkey without requiring an authenticated session. The system fails to call...

PT-2026-94406

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network scheduler where the qdisc get stab function accepts a user-supplied size table. The qdisc calculate pkt len function can amplify the qdisc pkt len value...

PT-2026-94401

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the packet classification path where the htb classify function does not bound the number of hops when following filter-selected inner classes. A filter on an inner cla...

CVE-2026-76154: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

PT-2026-94398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Fair Queuing fq scheduler where the change path accepts TCA FQ QUANTUM and TCA FQ INITIAL QUANTUM values up to INT MAX. This allows a user with CAP NET ADMIN...

PT-2026-94343

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.6.5 Description Stored cross-site scripting XSS exists in the admin dashboard due to unsafe HTML stripping in the RichTextDescriptionCell component within...

PT-2026-95154

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists in the admin/sources/maintenance.index.inc.php endpoint where administrator-controlled tablename values are inserted into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements witho...

CVE-2026-54613: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...