PT-2026-132261

Subscriber Broken Access Control in LearnPress = 4.4.10 versions...

PT-2026-118305

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

PT-2026-118579

Name of the Vulnerable Software and Affected Versions Participants Database versions prior to 2.7.8.5 Description An authorization bypass exists due to a user-controlled key, which allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version...

Linux kernel Control Flow DoS

The vulnerability of the Linux operating system’s kernel is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2024-56657)

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Avoid WARN for symlink errors Using WARN for showing the error of symlink creations don't give more information than telling that something goes wrong, since the usual code path is a lregister callback from each...

PT-2026-118423

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

Malware in codex-setup

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in chatgpt-pro-setup-tool

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in api-anthropic

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-111748

A flaw was found in aiohttp. A remote attacker can bypass security controls by sending an absolute-form HTTP request that spoofs the connection protocol scheme. This issue occurs because the framework evaluates attacker-controlled request-target data rather than verifying the underlying connectio...

GO-2026-6745 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission broken access control / privilege-management regression in v2.6.0 in code.vikunja.io/api...

GO-2026-6733 Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api...

CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

CVE-2026-76788

The Zephyr RTOS OSDP Control Panel reply parser contains a stack out-of-bounds write in cp_decode_response() within subsys/mgmt/osdp/src/osdp_cp.c. When processing REPLY_KEYPPAD or REPLY_RAW types, the parser fails to validate that the payload length stays within the fixed 64-byte OSDP_EVENT_MAX_...

CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

CVE-2026-112770

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-111750

A flaw was found in aiohttp. When running with the pure Python parser instead of compiled extensions, the parser accepts ambiguous HTTP Hypertext Transfer Protocol request framing. An unauthenticated remote attacker could exploit this flaw by sending specially crafted requests through an...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...