PT-2026-106313

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors...

ROS-20261006-73-0429

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-56596: Improper Input Validation

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...

ROS-20261006-73-0048

The vulnerability of the Linux operating system’s kernel security module, AppArmor, is related to coding errors. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of the protected information...

CVE-2026-105573: Undefined Security Weakness

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors...

ROS-20261006-73-0093

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-105755 vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's querykey value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

CVE-2026-105295

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

CVE-2026-105294 Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig

Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and...

ROS-20261005-73-0124

The vulnerability in the kernel-lt is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0020

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20261005-73-0021

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20261005-73-0016

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20261005-73-0018

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

FreeRDP RDP Client Buffer Overflow

The vulnerability of the channels/drdynvc/client/drdynvcmain.c file in the RDP client FreeRDP is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

Node.js HTTP Agent Data Compromise

The vulnerability of the Node.js software platform’s HTTP agent is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the protected information...

ROS-20261005-73-0043

The vulnerability in expat is related to synchronization errors. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data, or cause a service failure...

ROS-20261002-73-0055

The vulnerability of the refint module in the PostgreSQL database management system is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0160

The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...