PT-2026-78241

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve arbitrary accounts through GET /api/users/:id. The users/index and users/show actions rely only...

Linux Distros Unpatched Vulnerability : CVE-2026-74381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so i...

Linux Distros Unpatched Vulnerability : CVE-2026-68520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes...

Linux Distros Unpatched Vulnerability : CVE-2026-72239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert Drop WBINVD before setting MSRAMD64SYSCFGSNPEN Revert 99cf1fb58e68...

Linux Distros Unpatched Vulnerability : CVE-2026-72008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102137)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102137 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: schred: Replace direct dequeue call with peek and qdiscdequeuepeeked When red qdisc ha...

Achievement Unlocked: Let'S Get Hacked! an Empirical Study of Cybercrime in the Video Gaming Ecosystem

The ubiquity of the video game industry and its large user base have transformed video games into complex social and economic ecosystems. Unfortunately, this growing popularity also attracts cybercriminals who deliberately exploit game-specific mechanisms to target players. Despite this growing...

PT-2026-77281

Lemur manages TLS certificate creation. Prior to 1.9.3, validate acme url enforced ACME DIRECTORY HOST ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replac...

PT-2026-77226

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

PT-2026-77246

MobSF is a mobile application security testing tool used. Prior to 4.5.1, get browsable activities in mobsf/StaticAnalyzer/views/android/manifest analysis.py validates only an Android manifest android:host value with valid host before appending a separately supplied android:port to the URL fetche...

PT-2026-77182

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

PT-2026-77150

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

PT-2026-78233

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

PT-2026-78234

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register...

PT-2026-77266

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

PT-2026-77177

MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch remote file...

PT-2026-77298

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

Linux Distros Unpatched Vulnerability : CVE-2026-72287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into normal checks Move the off-by-default consistency check for vmcs12.tprthreshold vs. the virtual AP...

Linux Distros Unpatched Vulnerability : CVE-2026-72280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is...

Linux Distros Unpatched Vulnerability : CVE-2026-72412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/mm: Fix handling of PAGEUNUSED pte bit The PAGEUNUSED softbit should not really be lying around. Its sole purpose is to signal to trytounmapone and...