PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...

PT-2026-106798

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description An authenticated user with permissions to update or delete locally stored uploads can trigger a file cleanup process that removes unintended files...

PT-2026-106918

Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-106470

Unauthenticated Sensitive Data Exposure in Museder RestoreOne = 2.7.276 versions...

CVE-2026-106360: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106536

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the MMC-over-SPI systems where the mmc spi data do function updates the bytes xfered variable after each successfully transferred block. If a subsequent block in the same...

PT-2026-106555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management swap subsystem where the SWAP USAGE OFFLIST BIT flag collides with the actual usage count in the si-inuse pages counter. Because the flag is...

PT-2026-106592

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the ASOC codecs component specifically affecting the rt712-sdca-dmic. The stream config structure is not initialized before being passed to the sdw stream add slave...

PT-2026-106332

Name of the Vulnerable Software and Affected Versions Sitemovr versions prior to 1.0.2 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 1.0.1...

PT-2026-106457

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing = 6.2.3 versions...

PT-2026-106892

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Google Lens allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. Cross-origin data leakage...

Linux Distros Unpatched Vulnerability : CVE-2026-98207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later...

CVE-2026-94293: Missing Authentication for Critical Function

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-89289: Missing Authorization

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-41563: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-101153: Improper Limitation of a Pathname to a Restricted Directory

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

CVE-2026-39729: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Edwiser Bridge = 4.3.4 versions...

CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

CVE-2026-105865: Improper Limitation of a Pathname to a Restricted Directory

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-65142: Deserialization of Untrusted Data

NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...