CVE-2026-11835 Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

EUVD-2026-52549

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

CVE-2026-11835

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

PT-2026-80715

This update for multipath-tools fixes the following issues: Update to version 0.10.71+211+suse.18f1559. Security issues fixed: - kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device or disk imagebsc1268145. - kpartx: missing bounds...

PT-2026-67927

Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could...

PT-2026-67658

The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...

PT-2026-67660

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

PT-2026-67744

Name of the Vulnerable Software and Affected Versions kotaemon versions prior to 0.12.1 Description An insecure deserialization issue exists in the 'check connection' endpoint. Unauthenticated attackers can instantiate arbitrary Python classes by providing crafted YAML or JSON input containing a...

PT-2026-67694

Name of the Vulnerable Software and Affected Versions oidcc plug versions 0.2.0-beta.1 through 0.4.9 Description A Cross-Site Request Forgery issue in the Oidcc.Plug.AuthorizationCallback module allows an attacker to force a victim's browser to complete an unauthorized authorization flow. The...

PT-2026-67909

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that get verified user enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

PT-2026-67932

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

PT-2026-67570

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...

PT-2026-67747

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An issue exists where the '/api/v1/files' endpoint is protected only by a feature gate and fails to enforce permission checks on GET and DELETE requests. This allows an authenticated user with a...

ROS-20260804-73-0029

The vulnerability of the cfg80211checkandendcac function in the net/wireless/reg.c module, which supports wireless communication in Linux kernels, is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-67655

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history...

PT-2026-89553

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541969271 Crash type: Check failed Crash state: CheckUnwind mrb basic alloc func pm node hash insert...

PT-2026-74251

TuxCare rebuilt nth-check to address 1 CVE. Fixed in 1.0.2-tuxcare.1...

PT-2026-67664

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

PT-2026-67858

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.8 through 0.10.9 Description The terminal WebSocket route in backend/open webui/routers/terminals.py fails to apply the verified-user role gate that is enforced on HTTP terminal routes. Specifically, the resolve...

mingw-glib2 security update

2.70.1-9 - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 2.70.1-8 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves: RHEL-212184 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234 2.70.1-6 - Fix CVE-2026-58012...