PT-2026-93503

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak occurs in the qla2xxx driver within the SCSI subsystem. The function qla28xx validate flash image unconditionally returns QLA SUCCESS, signaling to the FC BSG transport...

CVE-2026-91949

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS...

PT-2026-92056

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag version and node...

CVE-2026-55866

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-55866

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-55866

SpiceDB (open-source permissions database), versions 1.34.0 through 1.54.0 , contains a cache-key collision bug in internal/dispatch/keys/computed.go where checkRequestToKey() and checkRequestToKeyWithCanonical() omit CheckHints when building dispatch Check cache keys. Under specific concurrency ...

CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

EUVD-2026-77689

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-90705

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90705 D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-90705

A OS command injection vulnerability was identified in D-Link DWR-M921 firmware version 1.1.52 . The flaw resides in the formsysCmd function of the file /boafrm/formsysCmd within the Boa Dispatch Table component. Manipulating the sysCmd argument allows a remote attacker with high privileges to in...

EUVD-2026-77356

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

PT-2026-91156

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

CVE-2026-55866: Incorrect Authorization

SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...

CVE-2026-90705: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/formsysCmd of the component Boa Dispatch Table. Executing a manipulation of the argument sysCmd can lead to os command injection. The attack can be executed remotely. The exploit has...

EUVD-2026-76913

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and m...

CVE-2026-90508: Missing Authorization

A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization...

CVE-2026-90485

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and m...