PT-2026-84080

Improper Input Validation vulnerability in ash-project ash typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ash typescript/typed controller/request handler.ex calls...

CVE-2026-84195: Exposure of Sensitive Information to an Unauthorized Actor

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-81892

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...

EUVD-2026-68763

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possibl...

CVE-2026-80643

A flaw was found in the Linux kernel's EDAC/igen6 driver. When this driver is unloaded, a missing 'release' function for memory controller devices can lead to a system call trace. This issue indicates a system error and could potentially result in system instability or a denial of service DoS...

CVE-2026-82876 Phison PS3111-S11 Controller Firmware Signature Verification Bypass

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the...

CVE-2026-82875

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any...

CVE-2026-82876: Improper Verification of Cryptographic Signature

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the...

Linux kernel Memory Controller DoS

The vulnerability in the mtksmilarbremove function within the drivers/memory/mtk-smi.c file of the Linux kernel memory controller driver is related to improper memory deallocation “memory leak”. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

UFS Host Controller Heap Buffer Overflow DoS

The vulnerability of the ufshcdwlsuspend function in the drivers/ufs/core/ufshcd.c file, which is part of the UFS Universal Flash Storage support for host controllers in Linux operating systems, relates to the activation of web functions from an unreliable source. Exploitation of this vulnerabili...

ufshcd_add_commandtrace Heap Buffer Overflow DoS

The vulnerability of the ufshcdaddcommandTrace function in the drivers/ufs/core/ufshcd.c file relates to the support for UFS host controllers in the Linux operating system’s kernel. This vulnerability involves the use of pointers. Exploiting this vulnerability could allow an attacker to cause a...

EUVD-2026-66215

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-55891

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

EUVD-2026-42994

Snipe-IT has an authorization bypass on print inventory page...

GHSA-FC33-6W3Q-538H Snipe-IT has an authorization bypass on print inventory page

Impact An authenticated user with only users.view can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license name...

CVE-2026-80694

CVE-2026-80694 is a type-mismatch bug in the Linux kernel's MediaTek mtk_eth_soc Ethernet driver. The function mtk_poll_controller incorrectly passed a net_device * to mtk_handle_irq_rx, which expects a struct mtk_eth * (the request_irq cookie). Calling ndo_poll_controller with CONFIG_NET_POLL_CO...

EUVD-2026-67429

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

PT-2026-86694

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: pass eth to mtk handle irq rx in poll controller mtk handle irq rx expects a struct mtk eth matching the request irq cookie, but mtk poll controller incorrectly passed the net device . Calling ndo poll...

Quantum-Based Solutions for Security Enhancement in Open Radio Access Networks

Open Radio Access Networks O-RAN introduce unprecedented flexibility, interoperability, and intelligence into next-generation wireless systems, but their disaggregated and software-defined architecture also expands the attack surface and creates new security vulnerabilities. Conventional...

PT-2026-82994

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtk eth soc ethernet driver where the mtk poll controller function incorrectly passes a net device pointer instead of a mtk eth structure pointer to the mtk handle...