CVE-2025-60465

A use-after-free in the gffilterpidinstswap function /filtercore/filterpid.c of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service DoS via supplying a crafted media file...

PT-2026-52461

Name of the Vulnerable Software and Affected Versions List::SomeUtils::XS versions prior to 0.59 Description A heap buffer overflow exists in the pairwise function. The function collects values returned by a block into a heap buffer sized according to the longer input array. When the buffer needs...

PT-2026-52387

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys...

PT-2026-52462

Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception. This issue affects HYPR Passwordless: before 11.1.1...

PT-2026-52275

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer over-read exists in the rtw update protection function within the rtl8723bs staging driver. This occurs because the function is called with a pointer offset into the ies buffer...

libpng security update

2:1.6.37-11 - fix CVE-2026-33416: use-after-free via pointer aliasing in pngsettRNS and pngsetPLTE RHEL-161344...

ansible.posix authorized_key Privilege Escalation

The vulnerability of the keyfile function in the ansible.posix.authorizedkey module is related to the incorrect definition of symbolic links when managing SSH keys. Exploiting this vulnerability could allow an attacker to enhance their privileges...

Security Framework Component Data Compromise

The vulnerability of the Security Framework component of the Oracle WebCenter Portal is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Oracle Identity Manager Connector DoS

The vulnerability of the Core component of the Oracle Identity Manager Connector, a software solution for managing user accounts and access rights, is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to...

RockyLinux 9 : flac (RLSA-2023:5048)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:5048 advisory. flac: Remote Code Execution RCE via the bitwritergrow function, by supplying crafted input to the encoder CVE-2020-22219 Tenable has extracted the preceding...

CVE-2026-40079

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escapecommand function. The escapecommand function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SaveAddress function. An attacker can access unauthorized local repositories by providing a crafted repository address in the Mirror Settings. Remediation Upgrade gogs.io/gogs/internal/form to version...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SaveAddress function. An attacker can access unauthorized local repositories by providing a crafted repository address in the Mirror Settings. Remediation Upgrade gogs.io/gogs/internal/route/api/v1/repo t...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the GET /api/v1/orgs/:orgname/teams endpoint, which returns organization team details without requiring authentication. An attacker can access sensitive information such as team IDs, name...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the GET /api/v1/orgs/:orgname/teams endpoint, which returns organization team details without requiring authentication. An attacker can access sensitive information such as team IDs, name...

EUVD-2026-38999

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

EUVD-2026-38796

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.getavatar function...

CVE-2026-53120

In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driveroverride infrastructure When a driver is probed through driverattach, the bus' match callback is called without the device lock held, thus accessing the driveroverride field without a lock, which can cause ...

CVE-2026-53110

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend...

CVE-2026-53080

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of "old" filters before change Like pointed out by Sashiko 1, since commit ed76f5edccc9 "net: sched: protect filterchain list with filterchainlock mutex" TC filters are added to a shared blo...