PT-2026-61409

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak exists in the batman-adv tp meter component during receiver shutdown. The receiver shutdown timer handler, batadv tp receiver shutdown, is responsible for releasing the ...

PT-2026-61375

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs read folio function where it fails to wait for an ongoing writeback to complete. This can lead to a situation where the system cannot trust the dirty flag or...

Linux Distros Unpatched Vulnerability : CVE-2026-53368

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix fsck inconsistency caused by incorrect natentry flag usage f2fsneeddentrymark reads natentry flags without mutual exclusion with the checkpoint path,...

Fedora 44 : libseccomp (2026-752186819e)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-752186819e advisory. libseccomp 2.6.1 packaging changes - Enable Python bindings on Fedora 44+ upstream changes - July 1, 2026 - Update the syscall table for Linux v7.1.0-rc4 - F...

CVE-2026-53368: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by incorrect natentry flag usage f2fsneeddentrymark reads natentry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The...

PT-2026-61381

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs component where netfs invalidate folio fails to clear the dirty bit when all changes in a folio are removed during a file truncation. This leaves the folio i...

PT-2026-61175

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the netfilter nf tables component where the process of moving hooks from the basechain or flowtable hook list to the transaction hook list during device deletions disrup...

PT-2026-61128

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs component where the destroy extent node function incorrectly handles the FI NO EXTENT inode flag. When this flag is set, the function fails to reset the lengt...

Exploit for CVE-2026-63030

wp2shell-scan A scanner and proof-of-concept toolkit for CVE-202...

GO-2026-5948 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend

Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend...

CVE-2026-48010

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEMSCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission...

CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

CVE-2026-48008

Shopware vulnerability CVE-2026-48008 describes privilege escalation via the Sync API. A non-admin API user with integration:create can set admin: true when creating an integration through POST /api/_action/sync, bypassing the normal admin-check that blocks admin flag on POST /api/integration. Th...

CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

CVE-2026-9202

CVE-2026-9202 affects IBM Langflow OSS versions 1.0.0–1.10.0. Unauthenticated attackers can create unlimited user accounts; if NEW_USER_IS_ACTIVE is true, new accounts are immediately active and can authenticate to reach RCE endpoints, bypassing AUTO_LOGIN. IBM CVSS v3.1 base score 9.8 (CRITICAL)...

CVE-2026-62230 Grav < 2.0.4 File Access Bypass via Case Variation

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

EUVD-2026-45118

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

CVE-2026-43978

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account gym manager, general manager by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a...

EUVD-2026-45067

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exis...