PT-2026-82941

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 "wifi: wlcore: Add support for IGTK key" lets the amount of ciphers decrease on every boot of a too old...

PT-2026-82889

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

PT-2026-82975

In the Linux kernel, the following vulnerability has been resolved: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map-sha against the metadata hash in its instructions. map-sha is calculated when BPF OBJ GET INFO BY FD is called on the frozen map. While the m...

The vulnerability of the Corosync cluster engine, which allows a hacker to trigger a service failure

The vulnerability of the Corosync cluster engine is related to incorrect checking of the return value of a function. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-83049

Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 2.0.0 through 7.0.0 Description OAuth server authorization checks can be bypassed when the server supports 2-legged authentication. Applications utilizing the AbstractAdapterCredentialsFilter for authorization filters are...

CVE-2026-82267: Missing Authorization

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

PT-2026-82894

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in ims pcu get cdc union desc by iterating through the extra descriptor data. However, it does not verify that t...

CVE-2026-51662

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-82909

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-len list Move index check before element access...

PT-2026-83350

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.3.12 Graylog versions prior to 7.0.7 Graylog versions prior to 7.1.2 Description An insecure direct object reference IDOR exists in the token revocation process. An authenticated user can delete access tokens...

PT-2026-83009

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

PT-2026-82872

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...

Linux Distros Unpatched Vulnerability : CVE-2026-80709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for...

CVE-2026-80609: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...

CVE-2026-79996: Improper Privilege Management

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

PT-2026-83010

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmt buffer size in dasd eckd check device format is declared as int, even though one of the multiplicands, sizeofstruct eckd count, is a size t. The expression trkcount rpt max...

The vulnerability of the PROXY protocol parser of the Exim mail server allows a hacker to cause a service failure.

The vulnerability of the PROXY protocol parser of the Exim mail server is related to the lack of checks for verifying that the value is within the minimum range. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-80703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Fix missing authorization check in KFDIOCDBGTRAPDISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/k...

CVE-2026-81729

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

CVE-2026-81729 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...