PT-2026-73230

Three pressures shaped this week's queue. Perimeter and analytics software came under confirmed attack, with three fresh KEV entries carrying remediation deadlines that have already passed. Microsoft shipped one of the largest security releases in its history. PostgreSQL shipped the largest singl...

PT-2026-72382

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx find buffer to prevent stack overflow indx find buffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded...

VulnCheck KEV: CVE-2016-5312

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. dot dot in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream...

PT-2026-72154

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

PT-2026-72346

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh get param size dfh get param size can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit...

PT-2026-72583

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 "hwmon: pmbus/core Protect regulator operations with mutex" introduced a worker to batch regulator events over time using atomic or. The delay...

PT-2026-72933

In the Linux kernel, the following vulnerability has been resolved: mm/page reporting: use system freezable wq to fix UAF during suspend During PM freeze e.g. S3 suspend or S4 hibernation, device drivers like virtio balloon reset their underlying virtio devices and delete their virtqueues via...

PT-2026-72157

Name of the Vulnerable Software and Affected Versions The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions prior to 30.0.8 Description An issue exists where authenticated attackers with author-level access and above can perform a Second-Order...

Linux Distros Unpatched Vulnerability : CVE-2026-72253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems...

Linux Distros Unpatched Vulnerability : CVE-2026-72084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESER...

Linux Distros Unpatched Vulnerability : CVE-2026-72398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried i...

PT-2026-72630

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf flow ip6 tunnel proto to use pskb may pull instead of skb header pointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequen...

PT-2026-72148

Name of the Vulnerable Software and Affected Versions Image Uploader for Welcart versions prior to 1.4.7 Description The Image Uploader for Welcart plugin for WordPress contains a SQL Injection flaw. This occurs because the plugin does not sufficiently escape the post title parameter and fails to...

PT-2026-72144

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...

PT-2026-72676

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw add element group count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw add element group count for-loop when i == num. for i = 0; i ratesi && lane ==...

PT-2026-72146

Name of the Vulnerable Software and Affected Versions User Session Synchronizer versions prior to 1.4.1 Description An authentication bypass exists that can lead to account takeover. The synchronize session function, which executes on every request, fails to validate nonces, capabilities, or shar...

PT-2026-72181

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENT SLEEP ...

PT-2026-72159

Name of the Vulnerable Software and Affected Versions Groundhogg versions prior to 4.5.15 Description The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with vendor-level access or higher can append malicious SQL...

PT-2026-72147

Name of the Vulnerable Software and Affected Versions MaxUpload – Big File Uploads – Increase Maximum File Upload Size versions prior to 1.4.1 Description An arbitrary file upload issue exists in the handle upload function. A filename-validation mismatch occurs because extension and MIME checks a...

PT-2026-72659

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing run lookup to return false. This causes run lookup entry to return false, which in turn results in a len value ...