CVE-2026-82879 DataEase before 2.10.26 Access Control Bypass via Share Tickets

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...

CVE-2026-80648

A flaw was found in the pinctrl pin controller driver for SpacemiT systems in the Linux kernel. An incorrect NULL check in the spacemitpinsetconfig function can lead to a NULL pointer dereference. This occurs when the system attempts to configure a pin that is not present in the SoC's pin table,...

CVE-2026-80636

A flaw was found in the Netfilter conntrack component of the Linux kernel. This vulnerability arises from the improper handling of connection tracking conntrack extensions. Specifically, a codebase change that disables all conntrack extensions for unconfirmed conntracks, without proper null check...

CVE-2026-77013

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

EUVD-2026-68366

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

PT-2026-83978

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84044

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check img type of the file admin/pack.php. Executing a manipulation of the argument pack img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to...

PT-2026-83996

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.5 Kirby versions prior to 5.5.2 Description The media handler in this content management system uses incomplete filesystem containment checks within src/Filesystem/Dir.php and src/Filesystem/F.php via the functions...

Linux Distros Unpatched Vulnerability : CVE-2026-80648

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per- pin descriptor with spacemitgetpin then checks the wrong...

Linux Distros Unpatched Vulnerability : CVE-2026-80609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - qede: fix out-of-bounds check for cqe-lenlist Move index check before element access. CVE-2026-80609 Note that Nessus relies on the presence of the package as...

PT-2026-83783

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...

The vulnerability of the Keyboard component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data and influence data integrity.

The vulnerability of the Keyboard component in Google Chrome and Microsoft Edge is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data and affect the integrity of data throu...

PT-2026-83708

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

PT-2026-83839

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::remove image checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83943

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

Amazon Linux 2023 : kbd, kbd-legacy, kbd-misc (ALAS2023-2026-2109)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2109 advisory. openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateus...

Linux Distros Unpatched Vulnerability : CVE-2026-80624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than...

Linux Distros Unpatched Vulnerability : CVE-2026-80595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data...