Unity Linux 20.1070e Security Update: cpio (UTSA-2026-130378)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130378 advisory. GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member name...

PT-2026-115220

The EnergizeLab AI Station RK3562 firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it...

CVE-2026-61610: Improper Access Control

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

...[ More ]

Vesta Control Panel VestaCP versions up to and including 0.9.8-26 contain an OS command injection vulnerability in the configuration parsing functionality. The shared shell library uses unsafe eval operations to process user-controlled configuration values, allowing an authenticated hosting accou...

UBUNTU-CVE-2026-81856

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the package repository and the documentati...

CVE-2026-110374: Missing Authorization

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77...

CVE-2026-95180

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...

PT-2026-115123

Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3...

CVE-2026-109897: Missing Authorization

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12...

PT-2026-115104

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77...

PT-2026-114971

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...

PT-2026-115110

Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

CVE-2026-96540

An improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to...

CVE-2026-55381

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...

CVE-2026-55382

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage not...

CVE-2026-96540

An improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to...

EUVD-2026-101629

An improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to...