CVE-2026-80743: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data. However, the driver data is only set at the end of probe, after...

PT-2026-85261

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback url/sync interval results in os command injection. The attack can be initiat...

AlmaLinux 10 : wget (ALSA-2026:62142)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:62142 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or...

Linux Distros Unpatched Vulnerability : CVE-2026-84366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler...

The vulnerability of the /goform/telnet file of the Telnet Handler component in the Tenda AC18 microprogramming router software, allowing a hacker to gain full control over the system

The vulnerability of the /goform/telnet file of the Telnet Handler component in the Tenda AC18 microprogramming router software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system...

The vulnerability of the ibmasm_handle_mouseinterrupt() function in the drivers/misc/ibmasm/remote.c file of the Linux operating system’s service processor IBM RSA driver module allows a attacker to disclose protected information or cause service failures.

The vulnerability of the ibmasmhandlemouseinterrupt function in the drivers/misc/ibmasm/remote.c file of the Linux operating system’s service processor driver module IBM RSA is related to an improper check of the specified index, position, or offset in the input data. Exploiting this vulnerabilit...

EUVD-2026-69647

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default...

CVE-2026-84852

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Ipados

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU...

CVE-2026-84852

A path traversal vulnerability exists in Reader Tools PDF Reader App version 98.8 for Android. The flaw resides in the ActSplashNew.handleDeeplink function of the File Handler component, where manipulation of the _display_name argument allows local path traversal. The attack requires local access...

EUVD-2026-70259

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

CVE-2026-52832

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

EUVD-2026-70215

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

AZL-99303 CVE-2026-18329 affecting package nginx for versions less than 1.30.4-1

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

EUVD-2026-70138

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

Kirby: Access to image files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix such as the site with the index root /var/www/site being next to /var/www/site2. It was...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the media handler process. An attacker can access files outside the intended directory and potentially obtain sensitive information by crafting requests that exploit incomplete containment checks for sibling...

GHSA-6J4C-MGQR-QV76 Kirby: Access to image files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix such as the site with the index root /var/www/site being next to /var/www/site2. It was...

BIT-SEAWEEDFS-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

BIT-CEPH-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...