EUVD-2026-38726

In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently forwards that request to idralloc with an open-ended upper bound. If...

CVE-2022-28206

creationtimestamp| type| source ---|---|--- 2026-06-24 07:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moze4zc3pd2n...

GHSA-58FG-62FG-3FCJ

creationtimestamp| type| source ---|---|--- 2026-06-24 06:12:05+00:00| seen| https://gist.github.com/alon710/e0871f429bd0cd1c539be9054ab3870b...

CVE-2026-12851

creationtimestamp| type| source ---|---|--- 2026-06-24 06:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116803556150711396...

CVE-2026-8690

The CVE describes an authorization bypass in the RentMy Real-Time Rental Management Plugin for WordPress, affecting all versions up to 4.0.4.1. The root cause is improper verification of a user’s authorization to perform actions, enabling unauthenticated attackers to read, create, update, and del...

CVE-2026-12416 Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the pravelinvoicechangepassword function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and...

CVE-2026-12416

The CVE affects the WordPress Invoice Generator plugin up to version 1.0.0. The root cause is pravel_invoice_change_password(), registered as a nopriv AJAX handler without nonce or authorization checks, which compares the supplied reset_activation_code to the user’s forgot_email meta with a loose...

GHSA-6F75-X745-XCPR

creationtimestamp| type| source ---|---|--- 2026-06-24 02:11:40+00:00| seen| https://gist.github.com/alon710/3da2d0271b4ce13266c6eb8e48512bfd 2026-06-24 02:22:36+00:00| seen| https://gist.github.com/alon710/e0c0df432c86420f7e6e4e56d0b5a192...

PT-2026-51716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free flaw exists in the ipc idr alloc function within the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation. The function forwards requests to id...

Linux Distros Unpatched Vulnerability : CVE-2026-12064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool laye...

Linux Distros Unpatched Vulnerability : CVE-2026-41423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21,...

PT-2026-51947

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the clone alias function within the AMD IOMMU driver. The function incorrectly assumes that the first argument pdev is always the original device pointer. Because pci...

PT-2026-51925

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the arena alloc pages function accepts an integer node id and forwards it through the allocation chain without performin...

PT-2026-51975

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Berkeley Packet Filter BPF verifier within the regsafe function. The issue occurs when comparing two scalar registers that both carry BPF ADD CONST values; the check...

Linux Distros Unpatched Vulnerability : CVE-2026-52923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently...

MINI-F972-FH2G-3HW7

Bulletin has no description...

MINI-QWHG-657F-36RQ

Bulletin has no description...

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support FMCS is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign companyi...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the BulkAssetsController::update process. An attacker can gain unauthorized access to assets belonging to other companies...

CVE-2026-54588 Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An...