EUVD-2026-68127

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470

Rodauth (a Ruby authentication library) before 2.47.0 contains a TOTP code reuse vulnerability in its otp feature. The root cause is a failure to track the last accepted code timestamp, allowing an attacker who observes a valid time-based one-time password to replay it within the drift window and...

CVE-2026-70309

An origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. The CVSS 3.1 score is 5.4 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating that exploitation requires user interaction and results in...

CVE-2026-70309 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

...

CVE-2026-70309 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

...

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management

Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...

CVE-2026-80712

This vulnerability affects the Linux kernel's spi-qpic-snand driver (Qualcomm QPIC SPI-NAND controller). The root cause is an off-by-one in SET_FEATURE command handling : qcom_spi_send_cmdaddr() submits and executes the command immediately, but the feature value is only written to NAND_FLASH_FEAT...

CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

MiracleLinux 9 : dotnet8.0-8.0.130-1.el9_8.ML.1 (AXSA:2026-1685:17)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1685:17 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

CVE-2026-25250

EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."...

Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cw6x-m8jw-qmrh. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows...

CVE-2026-25250

CVE-2026-25250 is a Windows Secure Boot security feature bypass caused by a missing cryptographic step in a Microsoft-signed third-party bootloader (EAZ EazyFix 12.9 ), which completely skips signature verification when loading drivers. An authorized local attacker with high privileges can bypass...

CVE-2026-25250

EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."...

CVE-2026-81724 NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

EUVD-2026-66882

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO...

PT-2026-82619

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description An uncontrolled recursion issue exists in the nltk.featstruct.FeatStructReader class. Unauthenticated attackers can trigger a denial of service by providing deeply nested feature-structure input, such ...

Linux Distros Unpatched Vulnerability : CVE-2026-81724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial ...

MiracleLinux 8 : dotnet8.0-8.0.130-1.el8_10.ML.1 (AXSA:2026-1674:16)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1674:16 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

CVE-2026-79055

A flaw was found in Google Chrome on Android. An information leak vulnerability exists in the Sharing feature. A local attacker, by leveraging social engineering tactics, could exploit this flaw through a co-installed application, potentially leading to the disclosure of sensitive information...