CVE-2026-106106: Improper Neutralization of Input During Web Page Generation

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

PT-2026-106888

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A race condition in WebAudio allows a remote attacker to potentially leak cross-origin data through the use of a crafted HTML page. A race condition occurs when the timing or order of...

PT-2026-106756

Name of the Vulnerable Software and Affected Versions @langchain/redis versions prior to 1.1.1 Description @langchain/redis fails to escape attacker-controlled values used in structured RediSearch TAG and TEXT filters. This allows the injection of RediSearch syntax to alter or broaden the generat...

Missing Role-Based Access Control (RBAC) and Logical Switch Isolation on Brocade Fabric OS MAPS Violation Data API Endpoint

: A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data acros...

React Router Vulnerable to Cross-Site Scripting (XSS) via Redirect Location Mishandling (CVE-2026-22029)

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...

PT-2026-106855

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An observable discrepancy in Animation allows a remote attacker to potentially obtain cross-origin data by using a crafted HTML page. Recommendations Update Google Chrome to version...

CVE-2026-89289: Missing Authorization

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-41563: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...

CVE-2026-101153: Improper Limitation of a Pathname to a Restricted Directory

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

CVE-2026-102157: Authorization Bypass Through User-Controlled Key

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

CVE-2026-42413: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate = 1.3.2 versions...

PT-2026-106416

Name of the Vulnerable Software and Affected Versions Edwiser Bridge versions prior to 4.3.5 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 4.3.4...

CVE-2026-39729: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Edwiser Bridge = 4.3.4 versions...

PT-2026-107143

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

PT-2026-106840

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.3.1 Description In the MongoDBChatMessageHistory component, the system fails to enforce the required string type for untrusted structured session identifiers at runtime. This allows a session identifier to be...

CVE-2026-98263: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98298: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

PT-2026-106340

Name of the Vulnerable Software and Affected Versions File Media Renamer versions prior to 1.4 Description The File Media Renamer WordPress plugin fails to verify if the requesting user is authorized to modify a specific media attachment. This allows any user with file-upload privileges to rename...

PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...