PT-2026-79506

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The plugin fails to enforce per-object ownership checks on its course content type. This allows users with the instructor role to access and read the content of private courses created by other...

Linux Distros Unpatched Vulnerability : CVE-2026-74596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems...

Linux Distros Unpatched Vulnerability : CVE-2026-74708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered...

Linux Distros Unpatched Vulnerability : CVE-2026-74681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it...

PT-2026-79590

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Thunderbolt subsystem where the tb drom parse entry port function fails to validate the dual link port nr field read from the Device ROM DROM. While the header-ind...

PT-2026-79706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Open vSwitch module where ovs flow key extract trusts the user-provided skb-protocol field. When a packet arrives on an ARPHRD NONE device, such as a TUN device, a...

PT-2026-79601

In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattr prepare The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case...

PT-2026-79698

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the prestera fw hdr parse function where the firmware header is read before verifying if the firmware image actually contains that header. This occurs when the system...

PT-2026-79676

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the xattr verify function. The issue occurs because the digest-length check mixes int and size t types. Since sizeof returns size t, the left-hand side of...

PT-2026-79583

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.3 Description The download element in the Fabrik extension for Joomla lacks a proper Access Control List ACL check. An ACL is a security mechanism that regulates which users or system processes are granted access t...

PT-2026-79553

Name of the Vulnerable Software and Affected Versions GreenShift – Animation and Page Builder Blocks versions prior to 12.9.0 Description The GreenShift – Animation and Page Builder Blocks plugin for WordPress allows unauthorized modification of data. The issue stems from a missing capability che...

PT-2026-79686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usbio bulk msg function where the ibuf len bulk IN receive buffer size is incorrectly compared against txbuf len bulk OUT endpoint size during an EMSGSIZE check...

CVE-2026-74681: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-53541

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

CVE-2026-34948

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

EUVD-2026-64203

OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...

EUVD-2026-64187

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948

Combodo iTop versions prior to 3.2.3 are affected by an access control bypass in its OQL (Object Query Language) engine. The root cause is that the silos access check only applies to classes present in the SELECT clause , leaving classes referenced via JOINs unprotected. This allows an authentica...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-34948 Combodo iTop: Access control bypass via OQL joins

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...