CVE-2026-98682: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

CVE-2026-110365: Missing Authorization

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

PT-2026-116901

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the destination page cache is not properly serialized against server-side copy and clone operations. Specifically, the cifs file copychunk range...

Vite 6.2.3 Arbitrary File Read

Vite versions before 4.5.11, 5.4.16, 6.0.13, 6.1.3, and 6.2.4 contain server.fs.deny bypasses that may expose arbitrary files through the development server. This proof of concept identifies exposed Vite servers and validates filesystem reads. https://packetstorm.news/download/236143...

MLflow 3.17.1 and Prior StartTrace Path Traversal

MLflow version 3.17.1 and prior versions using the FileStore tracking backend contain a path traversal vulnerability in the StartTraceV3 API. The proof of concept submits a traversal trace ID and demonstrates trace files written outside the intended trace directory...

WordPress WooCommerce Designer Pro 1.9.26 Arbitrary File Upload

WordPress WooCommerce Designer Pro versions 1.9.26 and prior contain an unauthenticated arbitrary file upload vulnerability in the wcdpsavecanvasdesignajax handler that may allow remote code execution. https://packetstorm.news/download/236146...

PT-2026-117160

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the...

PT-2026-116620

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...

CVE-2026-98777: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

PT-2026-116996

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the binder module where a TF UPDATE TXN transaction that supersedes a pending async transaction in a frozen process is freed using kfree directly. This action bypasses...

CVE-2026-98553: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

PT-2026-116772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A file reference leak occurs in the autofs component. When the autofs fill super function fails before clearing the AUTOFS SBI CATATONIC flag—such as when find get pid fails due to an...

CVE-2026-112059: Out-of-bounds Write

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116997

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the binder module where a TF UPDATE TXN transaction superseding a pending async transaction triggers binder release entire buffer with the is failure flag set to false...

VulnCheck KEV: CVE-2026-33309

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 External Control of File Name, leading to the root architectural issue within LocalStorageService remaining unresolved. Because the underlying...

VulnCheck KEV: CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-98778: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116590

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

CVE-2026-112013: Divide By Zero

libtta through 2.3 contains a divide-by-zero vulnerability in ttadecoderinitgetinfo that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the...