EUVD-2026-97187

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-21123

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-108796

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-108104

A flaw was found in snappy-java. A remote attacker can cause information disclosure or data corruption by supplying framed data with an excessively large chunk length. This input triggers an out-of-memory condition during buffer reallocation in SnappyFramedInputStream, causing pooled memory buffe...

EUVD-2026-97167

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The...

CVE-2026-108796

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the Biometric Data Endpoint component. Specifically, an unknown part of the /iclock/finger_data/ file allows for an authorization bypass when the emp_code argument is manipulated. This attack can be initiated remotely . No ...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-108982

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

Confluence Server - Remote Code Execution

Confluence Server and Data Center contain an OGNL injection vulnerability that could allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version...

PT-2026-110733

Name of the Vulnerable Software and Affected Versions Grav Data Manager plugin versions 1.4.0 through 1.4.5 Description Missing authorization allows unauthenticated attackers to delete stored data files through the classic Admin integration. By sending a request containing the delete parameter...

CVE-2026-109398: Improper Handling of Highly Compressed Data (Data Amplification)

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

PT-2026-111082

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.110.0 Frappe ERPNext versions 16.x prior to 16.21.0 Description Certain endpoints fail to enforce proper authorization checks during record status changes. This allows authenticated low-privileged users to...

PT-2026-111100

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

PT-2026-111032

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.3 Frappe ERPNext versions prior to 16.35.0 Description Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to send requests to these endpoints to modify data th...

PT-2026-111037

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.120.0 Frappe ERPNext versions 16.x prior to 16.33.0 Description Certain endpoints fail to enforce proper permission checks, leading to a missing authorization issue. This allows authenticated users with low...

ROS-20261012-73-0234

The vulnerability of the mctp-i2c.c component in the Linux operating system’s kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to access confidential data...

EulerOS 2.0 SP13 : libkcapi (EulerOS-SA-2026-4062)

According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an...