PT-2026-97850

Name of the Vulnerable Software and Affected Versions Excalidraw versions prior to 0.18.2 Description An issue exists in the Imported File Handler component within the packages/excalidraw/data/restore.ts file. A remote attacker can perform cross-site scripting XSS—a technique used to inject...

CVE-2026-97359: Improper Neutralization of Special Elements Used in a Template Engine

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

CVE-2026-97179: Exposure of Sensitive Information to an Unauthorized Actor

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of t...

CVE-2026-96892: URL Redirection to Untrusted Site

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used...

CVE-2026-96762: Authorization Bypass Through User-Controlled Key

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument clientid/segmentid causes authorization bypass. Remote exploitation of the attack is possible. The exploit...

PT-2026-98054

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the bpf sysctl set new value function fails to append a NUL terminator when replacing a pending sysctl value. While proc sys call handler typically ensures that...

PT-2026-104954

In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, proc sys call handler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpf sysctl set new value replaces the pending sysctl value, it can...

CVE-2026-97224: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. Th...

CVE-2026-97502

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: avoid NULL deref of host-data in IRQ handler mmcdavinciirq returns early only when both host-cmd and host-data are NULL: if host-cmd == NULL && host-data == NULL ... return IRQNONE; So we may legitimately reach the...

CVE-2026-97502: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: avoid NULL deref of host-data in IRQ handler mmcdavinciirq returns early only when both host-cmd and host-data are NULL: if host-cmd == NULL && host-data == NULL ... return IRQNONE; So we may legitimately reach the...

CVE-2026-97450

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

PT-2026-98207

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions prior to 0.4.12 Description Cross site scripting occurs in the Media Filename Handler component due to improper handling of the file path argument within the html function of the PlaylistManager.js file. This allow...

PT-2026-98159

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The video placeholder component allows crafted HTML to cause an attribute breakout...

PT-2026-98294

Name of the Vulnerable Software and Affected Versions react-native-debugger versions prior to 0.14.1 Description An OS command injection flaw exists in the Open in Editor Handler component. The issue occurs within the openDevTools function located in the electron/window.js file, where improper...

PT-2026-98260

Name of the Vulnerable Software and Affected Versions YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09 Description Improper authorization exists in the Demo-order Payment Callback Handler component. A remote attacker can manipulate the ID argument within the updateDemoOrderPaid functi...

CVE-2026-97233: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

PT-2026-98102

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur in the Linux kernel during root hub control transfers. This happens because the SCSI error handler, when managing errors in UAS and storage drivers, may attempt to...

PT-2026-104959

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpi ev has default handler and acpi ev find region handler...

Linux Distros Unpatched Vulnerability : CVE-2026-66067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/us...

PT-2026-97790

Name of the Vulnerable Software and Affected Versions Halo versions 2.25.4 and 2.26.1 Description A remote flaw exists in the SpEL Handler component within the ReplyNotificationSubscriptionHelper.java file. This issue involves improper neutralization in an unknown function, which could allow a...