PT-2026-76718

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

PT-2026-76715

The flash copy system call is verified by z vrfy flash copy in drivers/flash/flash util.c. On builds with CONFIG USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer K SYSCALL MEMORY WRITE and passed the two...

PT-2026-76684

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access token because User model objects are serialized after queries use...

PT-2026-76712

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in get ihpc inlined size subsys/net/ip/6lo.c. The destination inline size is looked up in da inline size table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPH...

PT-2026-76739

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

PT-2026-76766

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get barcode data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and m...

PT-2026-73237

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize value without the check forbidden xcom keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow...

PT-2026-73416

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100382)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100382 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: allow ext4getgroupinfo to fail Previously, ext4getgroupinfo would treat an invalid group...

PT-2026-76787

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive customers/inactive customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get sales details and get last sales amt, allowing an...

PT-2026-76725

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x astro path for the public / isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

PT-2026-76760

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

PT-2026-76835

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/user group id and POST /manage/admin/user-group/user group id/add-users endpoints in ee/onyx/server/user group/api.py call update user group and add users to user group in ee/onyx/db/user...

PT-2026-76825

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0 Description Authenticated users can bypass experiment-level READ permissions to access arbitrary files from another user's artifact directory. The issue occurs because the validate source run and validate source...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099741)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099741 advisory. In the Linux kernel, the following vulnerability has been resolved: nullblk: Always check queue mode setting from configfs Make sure to check device queue mode in th...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100181)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100181 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decodechooseargs A message of type CEPHMSGOSDMAP contai...

webpack_devserver 5.2.5 - CSRF

Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link: https://www.npmjs.com/package/webpack-dev-server Version: reaches launchEditorfileName from a CROSS-ORIGIN...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099744)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099744 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4fcreplayinode error paths During code review, Joseph found that...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099754)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099754 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocat...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099973 advisory. In the Linux kernel, the following vulnerability has been resolved: nouveau/dpcd: return EBUSY for aux xfer if the device is asleep If we have runtime suspended, and...