CVE-2026-93533: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

PT-2026-95512

Name of the Vulnerable Software and Affected Versions zot versions prior to 2.1.18 Description A flaw in the bearer authentication handler allows a remote attacker with a token limited to pull and push actions to delete manifests and blobs within the token's repository scope. This occurs because...

CVE-2026-93532: Improper Authentication

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...

Linux Distros Unpatched Vulnerability : CVE-2026-90171

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirectsocketdestr...

Linux Distros Unpatched Vulnerability : CVE-2026-92498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that th...

PT-2026-95508

Name of the Vulnerable Software and Affected Versions spatie Scotty versions prior to 1.4.5 Description OS command injection is possible via remote attack in the Doctor Command Handler component. The issue exists within the DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools...

PT-2026-95701

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1 Description The ratings plugin AJAX handler fails to validate anti-CSRF tokens, which are unique tokens used to prevent Cross-Site Request Forgery CSRF—an attack that forces an authenticated user to execute...

PT-2026-95711

Name of the Vulnerable Software and Affected Versions Open edX Platform versions Aspen.1 through Ulmo Open edX Platform versions Aspen.1 through Verawood.1 Description In the file openedx/core/lib/extract archive.py, the is bad path function validates safe extractall targets by comparing resolved...

PT-2026-95460

Name of the Vulnerable Software and Affected Versions gedelumbung HospitalManagement versions up to c2d45543789a3887067d3915f69d44cfc2cf76a8 Description Improper authentication occurs in the Password Change Handler component due to the manipulation of the kode user or username arguments. This iss...

PT-2026-95628

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description The Analytic Grid Service Handler contains a SQL injection flaw. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, which may lead to...

PT-2026-95308

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists in the netty-handler-ssl-ocsp component. A remote attacker can bypass security controls by providing an Online Certificate Status Protocol OCSP response that omits the optional...

CVE-2026-93534: Download of Code Without Integrity Check

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-92473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gfsgcommanddel of the file src/scenegraph/commands.c of the component BIF...

Linux Distros Unpatched Vulnerability : CVE-2026-92474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component...

Linux Distros Unpatched Vulnerability : CVE-2026-90397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe, devmrequestthreadedirq is called before smpstorerelease&scm,...

Linux Distros Unpatched Vulnerability : CVE-2026-93075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapo...

PT-2026-95509

Name of the Vulnerable Software and Affected Versions spatie Scotty versions prior to 1.4.3 Description A remote attack is possible through the Self Update Handler component. The SelfUpdater::update function in the app/Updater/SelfUpdater.php file allows the download of code without an integrity...

CVE-2026-90976: Improper Access Control

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...

CVE-2026-93870: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93493: Improper Check for Certificate Revocation

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...