CVE-2026-57920

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/orgId endpoints...

CVE-2026-57920

Peplink InControl 2 (affected versions 2 through 2.14.2, before 2026-06-03) is vulnerable to a access-control bypass via a semicolon in requests to certain /rest/o/{orgId} endpoints. The available documents confirm the vulnerability and affected product but do not provide exploitation steps or a ...

CVE-2026-57881

creationtimestamp| type| source ---|---|--- 2026-06-26 09:40:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp6nmtudxw2n 2026-06-26 10:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mp6qgiqq7n2j 2026-06-26 10:30:35+00:00| seen|...

CVE-2026-53243

A flaw was found in the Linux kernel. An uninitialized stack variable in the rseqexituserupdate function can lead to an information leak. This occurs due to an indeterminate sequencing of expressions during the initialization of the rseqids structure, where ids.nodeid is assigned using an...

CVE-2026-40082

A flaw was found in Cacti. This vulnerability, known as Session Fixation, occurs because the application does not regenerate the session identifier after a user successfully logs in. A remote attacker could exploit this by tricking a user into authenticating with a predetermined session ID,...

CVE-2026-54844

creationtimestamp| type| source ---|---|--- 2026-06-26 06:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp6c5vsvaf2n...

BELL-CVE-2026-8286

Bulletin has no description...

BELL-CVE-2026-53009

Bulletin has no description...

BELL-CVE-2026-52979

Bulletin has no description...

MAL-2026-6498 Malicious code in dttfdsdee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae565bed85ec0db27f1ff658c7e9491591ce40edc56f423cd8b1122bc209c69c package.json declares a postinstall script that runs automatically on npm install. The script walks the entire filesystem with find to locate databas...

SUSE CVE-2026-53137

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rxidlist read to buffer size Why & How During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field max value 1023. Th...

CVE-2025-71334

creationtimestamp| type| source ---|---|--- 2026-06-26 02:12:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5ulem5oj2x 2026-07-01 23:37:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmopslqvg2o 2026-07-02 05:37:06+00:00| seen|...

SUSE CVE-2026-53187

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpuid against nrcpuids in DMAH alloc The cpuid attribute supplied by user space through UVERBSATTRALLOCDMAHCPUID is passed directly to cpumasktestcpu without first verifying that the value is within the valid...

CVE-2026-50744

A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked...

CVE-2026-50744

A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked...

EUVD-2026-39591

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily...

EUVD-2026-39597

The Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mobile client and the backend REST API. Attackers could potentially reverse the signature to recover the session ID. With the...

CVE-2026-9219

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily...

PT-2026-52699

Name of the Vulnerable Software and Affected Versions Peplink InControl 2 versions 2 through 2.14.2 Description An access control bypass exists in certain /rest/o/orgId endpoints. This issue allows the use of a semicolon to circumvent established access-control rules. Recommendations Update Pepli...

PT-2026-52949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the soc/tegra: cbb component where a kernel page fault occurs during cross-fabric target timeout lookups. When a fabric receives an error interrupt that originated on ...