PT-2026-52789

Unauthenticated Broken Access Control in Flash & HTML5 Video = 2.11.0 versions...

PT-2026-52746

Unauthenticated Privilege Escalation in Paytium = 5.0.2 versions...

PT-2026-52843

Name of the Vulnerable Software and Affected Versions LXD versions prior to 6.9 LXD version 5.21 Description A nil-pointer dereference occurs in the CreateCustomVolumeFromBackup function when processing a specially crafted custom-volume backup tarball that omits the expires at snapshot field. An...

CVE-2026-54835: Missing Authorization

Unauthenticated Broken Access Control in Five Star Restaurant Menu = 2.5.2 versions...

PT-2026-52777

Unauthenticated Cross Site Scripting XSS in WoodMart = 8.5.3 versions...

CVE-2026-50765

A stored cross-site scripting XSS vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label...

PT-2026-52757

Unauthenticated Cross Site Scripting XSS in Customer Reviews for WooCommerce = 5.110.1 versions...

PT-2026-52795

Contributor Cross Site Scripting XSS in SeedProd Pro 6.19.5 versions...

SUSE SLES15: kernel-livepatch-5_14_21-150400_24_164-default / etc (SUSE-SU-2026:2567-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2567-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.164 fixes various security issues The following security issues were fixed: ...

trivy-0.71.2-1.1 on GA media (moderate)

trivy-0.71.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11102-1 Rating: moderate Cross-References: CVE-2026-47262 CVE-2026-50195 CVE-2026-53488 CVE-2026-53489 CVE-2026-53492 CVSS scores: CVE-2026-47262 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2026-50195 SUSE : 8.8...

Ubuntu 24.04 LTS / 25.10 : AMD Microcode vulnerabilities (USN-8475-1)

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8475-1 advisory. Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Kpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an...

GO-2026-5741 free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions in github.com/free5gc/udr

free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions in github.com/free5gc/udr...

GO-2026-5429 SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869) in github.com/siyuan-note/siyuan/kernel

SiYuan: Path Traversal via Double URL Encoding in /export/ Endpoint Incomplete Fix Bypass for CVE-2026-30869 in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If th...

DEBIAN-CVE-2026-6681

The PKCS7 decode path ignores the caller-supplied output buffer size outputSz, allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release...

CVE-2026-6681

The PKCS7 decode path ignores the caller-supplied output buffer size outputSz, allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release...

DEBIAN-CVE-2026-6412

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...

CVE-2026-6412

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...

CVE-2026-6412

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...

UBUNTU-CVE-2026-6679

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This...

mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...