CVE-2026-85507: Stack-based Buffer Overflow

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in outputdellsysteminfocmcinfo in ipmi-oem/ipmi-oem-dell.c cmc-info subcommand to dell get-system-info...

PT-2026-91780

In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security get classes security get classes sizes an array by p classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel make classes passes...

PT-2026-85401

Name of the Vulnerable Software and Affected Versions FreeIPMI versions prior to 1.6.19 Description A stack-based buffer overflow exists in the ipmi-oem component. The issue occurs within the output dell system info cmc info function located in ipmi-oem/ipmi-oem-dell.c, which is triggered when...

PT-2026-85402

Name of the Vulnerable Software and Affected Versions FreeIPMI versions prior to 1.6.19 Description A stack-based buffer overflow exists in the ipmi-oem tool. This issue occurs within the output dell system info cmc ipv6 info function located in ipmi-oem/ipmi-oem-dell.c, specifically when using t...

PT-2026-85689

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/order number in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-55512: Uncontrolled Resource Consumption

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC...

CVE-2026-85605: Missing Authorization

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

CVE-2026-85700: Insufficiently Protected Credentials

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in customheaders, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/toolid or GET /tool endpoints to retrieve plaintext authorization headers and...

CVE-2026-82911: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-85609: Server-Side Request Forgery (SSRF)

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery SSRF vulnerability in the GET /tools/site-checker endpoint apps/api/src/controllers/tools.controller.ts. The endpoint passes a user-supplied url query parameter to fetchWithRedirects and performs server-side...

CVE-2026-85236

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

CVE-2026-85236 MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

EUVD-2026-70518

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

CVE-2026-85236 MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

CVE-2026-85236

MISP is a threat intelligence platform. This CSRF vulnerability affected the cullEmptyEvents endpoint, which performed a state-changing, irreversible operation while accepting HTTP GET requests. Because bodyless GET requests bypass CakePHP's CSRF validation , an attacker could force an authentica...

CVE-2026-85236 MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

CVE-2026-85210 Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

CVE-2026-85210 Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with openaccess, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filtercriterion parameters to retrieve usernames holding specific roles, banned flags, an...

CVE-2026-85161

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests...

EUVD-2026-70396

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests...