PT-2026-70130

Name of the Vulnerable Software and Affected Versions Peppermint Lab Peppermint versions through commit ba6e217 Description Broken access control occurs because the Config.roles active flag defaults to false, which causes permission checks on ticket, client, and user handlers to behave as no-ops...

PT-2026-70402

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally...

CVE-2026-18941

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-13717

CVE-2026-13717 describes a misconfiguration in the Red Hat OpenShift AI (RHOAI) MaaS Gateway used in a model-serving context. The flaw permits a standard user with low privileges to intercept, read, log, and alter MaaS model traffic, including sensitive data such as access keys, input prompts, an...

CVE-2025-13293 Backdoor / default root credentials

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...

Eclipse Foundation OpenJ9: Eclipse OpenJ9: Incorrect method delegation can lead to integrity issues

A flaw was found in Eclipse OpenJ9. When executing specially crafted class files, the Java Virtual Machine JVM incorrectly delegates method calls from a recompiled abstract superclass method to an interface default method. This can lead to unexpected program behavior and potential data integrity...

Eclipse Foundation OpenJ9: Eclipse OpenJ9: Incorrect method delegation can lead to integrity issues

A flaw was found in Eclipse OpenJ9. When executing specially crafted class files, the Java Virtual Machine JVM incorrectly delegates method calls from a recompiled abstract superclass method to an interface default method. This can lead to unexpected program behavior and potential data integrity...

CVE-2026-68357

In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdogunregistergovernor When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov. If the governor being...

CVE-2026-68267

In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RINGFORCETONONPRIVDENY to OA whitelists Unconditionally whitelisting OA registers is a security violation. Set RINGFORCETONONPRIVDENY bit in OA nonpriv slots, so that OA registers don't get whitelisted by default...

EUVD-2026-55458

In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdogunregistergovernor When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov. If the governor being...

CVE-2026-68357 watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdogunregistergovernor When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov. If the governor being...

CVE-2026-72592

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-72593 dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem...

CVE-2026-72592 dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72574

The CVE-2026-72574 entry describes a host header injection in Pico CMS (Pico, up to version 2.1.4) where Pico::getBaseUrl() builds the base URL from unvalidated request headers (Host, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port) when base_url is unset. This allows an unauthenticated rem...

CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-21074

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-21074

Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege...

CVE-2026-21074

Affected software: Samsung Bixby prior to 4.0.86.0. The issue stems from incorrect default permissions, enabling local attackers to execute arbitrary commands with Bixby privilege. Impact is local privilege escalation; attack requires local access with low privileges and no user interaction. The ...