PT-2026-69568

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Andrew File System afs implementation where the afs edit dir remove function incorrectly uses afs dir find block to retrieve block 0. Because afs dir find block...

PT-2026-69532

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the emergency thaw worker can deadlock when handling frozen block devices. This occurs because the function do thaw all callback calls bdev thaw while holding the...

PT-2026-69647

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/i915/bios component where the panel type2 variable from the LFP Data Block is not range checked, unlike the panel type variable. This lack of validation can...

Linux Distros Unpatched Vulnerability : CVE-2026-68132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen...

CVE-2026-18988 Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...

EUVD-2026-54712

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...

Security Bulletin:Vulnerability in Curl affects IBM Netezza Appliance

Summary The Curl package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-3805 Vulnerability Details CVEID:CVE-2026-3805 DESCRIPTION: When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already...

CVE-2026-54204

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

CVE-2026-54206

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

EUVD-2026-54450

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54207

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54207

CVE-2026-54207 affects Tobit TeamDavid’s Webbox move-archive feature (ArcEntryMove). The function accepts an arbitrary path, including UNC network paths like \Server\Share, which the server processes without validation. This can trigger outbound connections to attacker-controlled SMB servers, all...

EUVD-2026-54438

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54206 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54206

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54206

CVE-2026-54206 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue is a server-side inclusion/SSRF via the pathname parameter in the sending functionality, which can be set to UNC paths (e.g., \Server\Share). The server processes these paths without validation, causing outbound connection...

btrfs: do not trim a device which is not writeable

...

drm/edid: fix OOB read in drm_parse_tiled_block()

...

WP 7.0.x - Unauthenticated Password Protected Post Comment Disclosure via Gutenberg Latest Comments Block

Description Gutenberg does not check whether a post is password protected before displaying the full text of its comments, which could allow unauthenticated users to read comments left on password protected posts. The affected block ships both in the Gutenberg plugin and, bundled, in WordPress co...