PT-2026-117695

Name of the Vulnerable Software and Affected Versions Zephyr OS affected versions not specified Description An issue exists in the user-mode syscall verifier z vrfy rtio cqe get mempool buffer within subsys/rtio/rtio syscalls.c. The verifier incorrectly uses K SYSCALL MEMORY READ instead of K...

CVE-2026-112309: Improperly Controlled Modification of Object Prototype Attributes

@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form...

CVE-2026-112291: Missing Authorization

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

CVE-2026-112779: Allocation of Resources Without Limits or Throttling

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

PT-2026-117652

Name of the Vulnerable Software and Affected Versions TiBillet Lespass versions up to 10e87909c5d526dffa6d424c104fc12860740537 Description A weakness in the APIv1 component allows for server-side request forgery, a condition where an attacker can induce the server to make requests to an unintende...

PT-2026-117630

Name of the Vulnerable Software and Affected Versions Grav API plugin grav-plugin-api versions 1.0.16 through 1.0.41 Description The plugin contains two distinct issues. First, the unauthenticated GET '/api/v1/translations/lang' endpoint caches a full translation dictionary for every well-formed...

PT-2026-117393

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-109844

The Gitea repository management platform is affected by a vulnerability where the GET /api/v1/user/subscriptions endpoint fails to verify if a user still maintains access to a watched repository. Consequently, a user who previously had access to a private repository but subsequently lost those pe...

CVE-2026-109844 Gitea watched repositories API disclosure after access revocation

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its...

jellyfin-suggestions-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · jellyfin-suggestions-idor jellyfin-suggestions-idor Jellyfin Server 12.2 - Jellyfin Class: IDOR. Reach: Remote any authenticated non-admin. GET /Items/Suggestions is Authorize only. When userId is omitted,...

CLSA-2026-1792308469 TuxCare security update for @babel/helper-get-function-arity (2 CVEs)

TuxCare rebuilt @babel/helper-get-function-arity to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

PT-2026-116754

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in read dts node of clk get returns a clock with its reference count incremented, but read dts node only uses it to read the rate and never calls clk put. The clock is not stored anywhere, so the...

PT-2026-116702

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc get local general bytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfc llcp find local" attempted to fix a use-after-free UAF issue by invoking nfc llcp local putlocal after accessi...

PT-2026-116818

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack slot obj get spi bpf get spi computes -off - 1 / BPF REG SIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot...

PT-2026-116947

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2 get random When the response carries the TPM2 ST SESSIONS tag, tpm2 get random skips the 4-byte parameter size field before locating the random data, but the bounds check still validates...

PT-2026-117052

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call get device with the master MTD get mtd device calls the master's get device callback with mtd, which may be a partition. put mtd device passes the master. This breaks gluebi partitions because gluebi get device us...

PT-2026-117044

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm clk get error pointer in probe devm clk get&pdev-dev, "rtcref"'s return value was passed straight into clk get rate without checking it for an error first, unlike the "rtc" clock a few lines above...

PT-2026-116695

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...

CVE-2026-111930

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111905

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...