PT-2026-81920

SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow...

CVE-2026-2388: Improper Neutralization of Input During Web Page Generation

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

PT-2026-82049

Name of the Vulnerable Software and Affected Versions Reviews and Rating – Google Reviews plugin for WordPress versions prior to 5.11 Description Stored Cross-Site Scripting occurs because the wp display shortcode handler allows attacker-controlled html tags values to define raw HTML tags and emb...

CVE-2026-81202: Missing Authentication for Critical Function

A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed fr...

CVE-2026-58093: Concurrent Execution using Shared Resource with Improper Synchronization

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

CVE-2026-80560: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restoresigcontext copies the whole supervision register SR from the signal frame and only clears SPRSRSM before the value is reloaded into the hardware SR through E...

Linux Distros Unpatched Vulnerability : CVE-2026-74754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: core: pair EH runtime PM get and put shost-ehnoresume is currently consulted twice in one error handling iteration: once before scsiautopmgethost and once...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104594)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104594 advisory. In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls...

VulnCheck KEV: CVE-2026-36425

An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...

The vulnerability of the Lz4Decode function in the NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp component of the SquashFS compiler, a 7-Zip-based archive compressor, allows a hacker to disclose protected information and cause a service failure.

The vulnerability of the Lz4Decode function in the NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp component of the SquashFS compressor, a 7-Zip-based archive compressor, involves reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to...

PT-2026-82198

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/shmem helper component where the -huge fault handler fails to verify if a PMD Page Middle Directory huge page mapping exceeds the boundaries of the VMA Virtual...

Linux Distros Unpatched Vulnerability : CVE-2026-80582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/shmemhelper: Check VMA boundaries for PMD mappings In the -hugefault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries ...

Linux Distros Unpatched Vulnerability : CVE-2026-80562

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: ml-ioh: use rawspinlockt for the register lock iohirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098671)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098671 advisory. A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver...

CVE-2026-79911

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible t...

CVE-2026-79911 TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible t...

CVE-2026-79911 TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible t...

CVE-2026-63403 Faktory: Unrecovered panic in command handlers allows full-server denial of service

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the...

CVE-2026-63403 Faktory: Unrecovered panic in command handlers allows full-server denial of service

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the...

CVE-2026-65086

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering...