EUVD-2026-57006

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...

EUVD-2026-57005

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

EUVD-2026-57009

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range approximately 10–30 meters can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via...

EUVD-2026-57021

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

PT-2026-71101

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An unauthenticated user may access restricted repository information under specific conditions. Recommendations At the moment, there is no information about a...

PT-2026-71076

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17...

PT-2026-71000

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.20 Description Insufficient access restrictions to individual order records allow users with contributor-level permissions or higher to access other customers' order data, including personal...

PT-2026-71032

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase...

PT-2026-71111

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description An insecure deserialization issue exists where a party with write access to stored session data may affect the system under specific conditions. Insecure deserialization occurs when...

CVE-2025-59322

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext...

Linux Distros Unpatched Vulnerability : CVE-2026-68167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the...

Linux Distros Unpatched Vulnerability : CVE-2026-68330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write...

PT-2026-71245

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks in the 'getBlockAttrs' and 'batchGetBlockAttrs' endpoints allow attackers to retrieve block attributes from protected documents. By sending POST requests containing...

PT-2026-71015

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

CVE-2025-59323

CPSD CryptoPro Secure Disk for Bitlocker (before v7.7.4) is affected. The issue arises because the product fails to validate the integrity of the DataStore, a non-partitioned filesystem that stores configuration and cryptographic details. As a result, crafted DataStore contents can impact service...

PT-2026-71240

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists in the renderAttributeView function where related-database content is not properly filtered. This allows anonymous readers or users with RoleReader permissions to access sensitive...

PT-2026-71117

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...

PT-2026-71334

The type=track branch authorises on is my caset attach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...

Linux Distros Unpatched Vulnerability : CVE-2026-68089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer wi...

Linux Distros Unpatched Vulnerability : CVE-2026-73229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py...