CVE-2026-75168

MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) contains a vulnerability in the ugw-editfile method of /cgi-bin/wwwugw.cgi that allows a remote, authenticated user holding the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. The CVSS 3.1 ba...

CVE-2026-75167

CVE-2026-75167 is a broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user holding only the low-privileged Standard role can change the password of arbitrary accounts , enabling privile...

Unbreakable Enterprise kernel security update

5.4.17-2136.359.3.1 - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974845 CVE-2026-80590 5.4.17-2136.359.3 - Partial revert of 'x86/alternatives: Optimize optimizenops' Harshit Mogalapalli Orabug: 39866546 - Revert 'x86/alternatives: Add altinstr.flags' Harsh...

PT-2026-85427

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

EUVD-2026-71452

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...

PT-2026-85676

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

PT-2026-85714

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtio crypto dataq akcipher callback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the...

CVE-2026-75162

CVE-2026-75162 is an information disclosure vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 , specifically in the opcua-configuration method of /cgi-bin/wwwugw.cgi. Any remote authenticated user—including those with the low-privileged Standard role—can retrieve configured OPC-UA ...

Flextype CMS 1.0.0-alpha.3 Path Traversal

Flextype CMS version 1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy functionality. An authenticated remote attacker can supply directory traversal sequences within both the source id and destination newid parameters submitted to /api/v1/entries/copy...

Linux Distros Unpatched Vulnerability : CVE-2026-80852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tls: device: fix out-of-bounds write in tlsappendfrag Found with syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation;...

PT-2026-85492

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

PT-2026-85805

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The cache interceptor incorrectly handles the caching of unsafe HTTP methods. While documentation states only safe methods are cached, the logic used to skip...

PT-2026-85556

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...

The vulnerability of the Element.setAttribute() method in the XML Document Access and Management Module XMLDOM allows a attacker to perform cross-site scripting (XSS) attacks.

The vulnerability of the Element.setAttribute method in the XML document access and manipulation module XMLDOM is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-80785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: serialize mode sysfs access with lockfbinfo showmode, showmodes, and storemode access fbinfo-modelist and fbinfo-mode without holding lockfbinfo...

CVE-2026-75161

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

PT-2026-85609

In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after-return write in I2C read race ft260 i2c read points dev-read buf at a caller-supplied buffer often an on-stack variable, arms a completion and waits up to five seconds for the device to return the...

EUVD-2026-71451

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

CVE-2026-75163

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

PT-2026-85678

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6 00 05 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...