Oracle Java SE Libraries DoS

The vulnerability of the Libraries component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to cause service interruptio...

Security Component Unauthorized Access

The vulnerability of the Security component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker operating remotely to gain...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libevent (UTSA-2026-124534)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124534 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...

PT-2026-98302

Name of the Vulnerable Software and Affected Versions iSteamX mobile application versions prior to 9/18/2026 Description The AWS policy of the application allows authenticated users to access wildcard MQTT topics. This flaw enables an attacker to expose device data from other users and control...

ASRock IO Driver version 1.00.00.0000 Improper Access Control

ASRock IO Driver version 1.00.00.0000 contains an improper access control vulnerability in AsrDrv103.sys. Included research analyzes the vulnerable driver and its encrypted IOCTL mechanism...

PT-2026-104956

In the Linux kernel, the following vulnerability has been resolved: usb: core: hcd: fix possible deadlock in rh control transfers From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doi...

CVE-2026-86858: Improper Access Control

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNo...

MiracleLinux 9 : libevent-2.1.13-1.el9_8 (AXSA:2026-1905:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1905:02 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial o...

Linux Distros Unpatched Vulnerability : CVE-2026-97483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: core: hcd: fix possible deadlock in rh control transfers From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS...

CVE-2026-74991: Improper Access Control

The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other...

CVE-2026-97483: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: core: hcd: fix possible deadlock in rh control transfers From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doi...

PT-2026-98287

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The FastCGI client access check for IPv6 addresses incorrectly compares only the first 12 bytes of a 16-byte address. This causes the listen.allowed clients chec...

CVE-2026-75907: Improper Authentication

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on...

PT-2026-98238

Name of the Vulnerable Software and Affected Versions Docmost versions 0.70.0 through 0.80.0 Description An authenticated user with low privileges who can edit an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the page is exported using...

Oracle Java SE DoS

The vulnerability of the JSE component of Oracle Java SE software, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Oracle Java SE DoS

The vulnerability of the Oracle Java SE 2D software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to cause service interruptions...

CVE-2026-76816

A flaw was found in Netty. The MqttEncoder component does not properly validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding. This allows an attacker to inject prohibited null bytes into MQTT Message Queuing Telemetry Transport UTF-8 string fields when an...

automation-controller: automation-controller-container: automation-controller: Project scm_url argument injection into `git ls-remote --upload-pack` yields RCE on the controller-task control-plane pod

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

automation-controller: automation-controller-container: automation-controller: container group pod_spec_override mints the automation-controller ServiceAccount token and mounts control-plane namespace secrets into job pods, bypassing automountServiceAccountToken:false (control-plane secret and identity compromise)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only...

automation-controller: automation-controller: WorkflowJobTemplate /copy/ deep-copy sanitizer omits instance_groups authorization (InstanceGroup use_role bypass to control-plane)

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...