PT-2026-103596

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...

ROS-20260930-73-0034

The vulnerability of the updateeth regs async function in the drivers/net/usb/pegasus.c file of the Linux network adapter driver module is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

ROS-20260930-73-0110

The vulnerability of the drivers/net/can/usb/usb8dev.c component in the Linux kernel is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-103106

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.20.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 Description Improper input validation in the sshd-git component allows authenticated SSH clients to potentially execute unauthorized git commands. Th...

CVE-2026-93547: Improper Authorization

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-97253: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-94545: Improper Encoding or Escaping of Output

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

CVE-2026-62084: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810...

CVE-2026-100259: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-96824: Improper Limitation of a Pathname to a Restricted Directory

Editor Arbitrary File Deletion in Template Kit – Import = 1.0.16 versions...

CVE-2026-103584: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting XSS. This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43...

CVE-2026-102111: Improper Validation of Specified Quantity in Input

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative...

CVE-2026-102106: Improper Authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102093: Improper Privilege Management

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full...

CVE-2026-102132: Improper Access Control

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system...

CVE-2026-88797: Improper Access Control

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-75824: Improper Access Control

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

CVE-2026-75823: Improper Privilege Management

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

CVE-2026-100143: Improper Authentication

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...

CVE-2026-103110: Out-of-bounds Write

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...