PT-2026-117933

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI session.req header.uri saw the :authority value, but the upstream received the client-supplied Host value...

PT-2026-118305

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

PT-2026-120134

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability ...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2024-56657)

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Avoid WARN for symlink errors Using WARN for showing the error of symlink creations don't give more information than telling that something goes wrong, since the usual code path is a lregister callback from each...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the kfdcriuresumesvm function within the drivers/gpu/drm/amd/amdkfd/kfdsvm.c file of the Linux kernel operating system is related to insufficient resource control during its existence. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality,...

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655...

CVE-2026-59387 - broken access control restriction in Cloud Controller API | Cloud Foundry

Severity High CVSS score: 8.8 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.245.0 inclusive Description The Nginx routing configuration for Cloud Controller blocks unauthenticated acce...

PT-2026-118994

Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-118856

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Improper access control in DevTools allows a remote attacker to potentially leak sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-118826

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Improper access control in Extensions allows a remote attacker to potentially leak sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to...

Google Chrome Vulnerability: CVE-2026-113129

Improper access control in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

Google Chrome Vulnerability: CVE-2026-113029

Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

Google Chrome Vulnerability: CVE-2026-113030

Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-118424

Name of the Vulnerable Software and Affected Versions Booktics versions prior to 1.0.31 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to version 1.0.31 or later...

Siemens SIMATIC S7-1500 TM MFP Improper Control of a Resource Through its Lifetime (CVE-2026-43503)

"In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers pskbcopyfclone and skbshift fail to propagate the SKBFLSHAREDFRAG bit in skbshinfo-flags when moving frags from source to...

Malware in codex-setup

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in api-anthropic

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in chatgpt-pro-setup-tool

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-111748

A flaw was found in aiohttp. A remote attacker can bypass security controls by sending an absolute-form HTTP request that spoofs the connection protocol scheme. This issue occurs because the framework evaluates attacker-controlled request-target data rather than verifying the underlying connectio...

GO-2026-6733 Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api...