CVE-2026-62428: Time-of-check Time-of-use (TOCTOU) Race Condition

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is "pinned", what is...

PT-2026-65395

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...

PT-2026-65437

Name of the Vulnerable Software and Affected Versions GStreamer gst-plugins-good affected versions not specified Description A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. This issue is triggered by a...

mailpit -- WebSocket origin check bypass via percent-encoded path

Mailpit author reports: The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the...

PT-2026-68532

Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons versions prior to 8.7.14 Description The Element Pack Addons for Elementor plugin for WordPress allows unauthorized access because it fails to perform a capability check on a specific function. This flaw enables...

ROS-20260728-73-0007

The vulnerability in the mongo-c-driver is related to copying buffers without checking the size of the input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-64547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: usb: net1080: validate packetlen before pad-byte access in rxfixup For an even packetlen, net1080rxfixup reads the pad byte at skb-datapacketlen before the...

TencentOS Server 3: python-pillow (TSSA-2026:0769)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0769 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-51260

CVE-2026-51260 affects the schreibfaul1 ESP32-audioI2S component (version 3.4.5). The issue is an unsafe fixed-size memcpy in AudioBuffer::writeSpace(), where a full UINT16_MAX bytes are copied without validating available destination space, causing an out-of-bounds heap write. This is the concre...

PT-2026-65392

The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...

CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

CVE-2026-59240

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

AZL-94029 CVE-2026-64552 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

CVE-2026-64552

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

CVE-2026-64550

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnetmapingresshandler passes the skb straight to rmnetmapingresshandler, skipping the length validation that...

CVE-2026-64544

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...

UBUNTU-CVE-2026-64545

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without a NULL check, but that helper returns NULL when the receiving device has no upper-master...

CVE-2026-64552 virtio-net: fix len check in receive_big()

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

CVE-2026-64551 sctp: validate STALE_COOKIE cause length before reading staleness

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...