PT-2026-103073

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An Editor can set file-provisioning metadata when creating a dashboard through the dashboard API because certain fields are stored without an authorization check. This allows the creation of...

CVE-2026-102106: Improper Authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102583: Direct Request

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI...

PT-2026-103572

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An authorization check in the large file exchange feature does not correctly verify if the requesting user is a party to the requested package. This allows an...

PT-2026-105515

Summary PyJWT.decode/decode complete mutates a caller-supplied options dict in place whenever verify signature is falsy, adding verify exp/verify nbf/verify iat/verify aud/verify iss/verify sub/verify jti keys directly onto that object. If application code reuses the same options dict across call...

CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1782977299)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782977299 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the...

CVE-2026-102104: Server-Side Request Forgery (SSRF)

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

PT-2026-103035

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-95616: Integer Overflow or Wraparound

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

PT-2026-103109

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 1.0.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 Description Server-side memory exhaustion occurs in the sshd-sftp component within the SFTP v6 check-file-name/check-file-handle extension. When...

PT-2026-103087

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course without proper permission,...

PT-2026-103596

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

Impact fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference //host there is no scheme, so the host canonicalization that repairs this on a...

GHSA-HRR3-GC8F-F4QJ fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

Impact fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference //host there is no scheme, so the host canonicalization that repairs this on a...

SUSE CVE-2026-77955

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones zonemd-check: yes which are located below but not at a trust anchor allow for an attack window where tampered with zone contents are served or stored to disk prior to the ZONEMD integrity check. Th...

GHSA-P634-W6R4-RJP2 adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...

CVE-2026-102930

A flaw was found in virtualenv. When fetching seed packages such as pip or setuptools during environment creation or updates, virtualenv does not verify the integrity of downloaded files against authoritative cryptographic checksums. A network attacker or compromised mirror could substitute...

CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

CVE-2026-102930 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...