CVE-2026-72581: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...

The vulnerability of the smp_cmdPairingReq() function in the net/bluetooth/smp.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smpcmdPairingReq function in the net/bluetooth/smp.c module of the Linux operating system is related to insufficient security checks for protected connections. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

PT-2026-69971

Name of the Vulnerable Software and Affected Versions libvirt affected versions not specified Description A symlink-following flaw exists in the virFileChownFiles function. A local attacker operating as the confined swtpm user can place a symbolic link in the swtpm state directory to trick the...

PT-2026-69995

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description Certain web interface components fail to properly validate and sanitize user-supplied input before passing it to system-level command execution functions. This allows an authenticated...

PT-2026-69463

Name of the Vulnerable Software and Affected Versions NASA HyperCP main branch Description An OS command injection issue exists where a network-adjacent attacker can execute arbitrary system commands on a researcher's workstation by intercepting or spoofing responses from the...

CVE-2026-72580: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

ROS-20260810-73-0025

The vulnerability in gpac is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260810-73-0028

The vulnerability in etcd is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

PT-2026-69922

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with application create or update permissions can execute arbitrary commands on the local build host or a remote SSH build target. This occurs because the dockerImage field is...

CVE-2026-21080: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-21079: Missing Encryption of Sensitive Data

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...

The vulnerability in the Firefox web browser, related to writing beyond the buffer limit, allows a hacker to trigger a service failure.

The vulnerability in the Firefox web browser is related to writing beyond the buffer limit. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-59091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user...

CVE-2026-21073: Undefined Security Weakness

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

CVE-2026-21083: Improper Input Validation

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-72692: Missing Authorization

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes...

CVE-2026-72584: Time-of-check Time-of-use (TOCTOU) Race Condition

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-72564: Authorization Bypass Through User-Controlled Key

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

The vulnerability in the Firefox web browser and Thunderbird email client relates to the issue of operations going beyond the buffer boundaries in memory, allowing attackers to trigger a service failure.

The vulnerability in the Firefox web browser and Thunderbird email client is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Vulnerability of the network driver for Windows Server operating systems, allowing a hacker to execute arbitrary code

The vulnerability of the Windows Server operating system’s network driver is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...