PT-2026-67241

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X series...

PT-2026-67494

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 2.10.0 Description Authorization handling for Parameter Context validation requests allows clients with read access to submit proposed Parameter values. These proposed values override the current...

Linux Distros Unpatched Vulnerability : CVE-2026-69097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through...

Hanwha Vision Cameras OS Command Injection (CVE-2024-54012)

Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be executed on the device. The manufacturer has released patch firmware for the flaw; please refer to...

CVE-2026-67969

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

PT-2026-67449

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

CVE-2026-67974

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

Linux Distros Unpatched Vulnerability : CVE-2026-12803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross- nonce AEAD forgery. This issue also affects Bouncy Cast...

ROS-20260803-73-0021

The vulnerability of the stmmactsoxmit function in the drivers/net/ethernet/stmicro/stmmac/stmmacmain.c file of the Ethernet driver module from STMicroelectronics’ operating system Linux is related to the lack of proper validation for incoming requests. Exploiting this vulnerability could allow a...

PT-2026-67425

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-3245

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution...

CVE-2026-64371

A flaw was found in the Linux kernel's procfs a virtual filesystem that provides information about running processes. This vulnerability occurs because certain functions within procfs do not properly protect access to process memory information. A local attacker could exploit this missing...

CVE-2026-64339

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. A malicious or malfunctioning Universal Serial Bus USB device can exploit this vulnerability by providing crafted input during a bulk IN transfer. This can lead to an out-of-bounds read, allowing the devic...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-15939

creationtimestamp| type| source ---|---|--- 2026-08-02 10:54:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3sytcj3t2z 2026-08-02 11:50:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3w6266kl2v 2026-08-02 11:51:03+00:00| seen|...

CVE-2026-18572

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

CVE-2026-16042

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds...

CVE-2026-16062

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

CVE-2026-16291

The CVE describes a vulnerability in the ProfileGrid WordPress plugin (before 5.9.9.8) where deletion of notifications does not verify ownership; any authenticated user (e.g., a Subscriber) can delete other users’ notifications by enumerating notification IDs. Root cause: lack of ownership checks...