CVE-2026-86136: Improper Limitation of a Pathname to a Restricted Directory

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-62083: Improper Validation of Specified Quantity in Input

Subscriber Other Vulnerability Type in Creator LMS = 1.2.19 versions...

CVE-2026-92868: Improper Certificate Validation

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication...

CVE-2026-85532: Improper Input Validation

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...

CVE-2026-79625: Concurrent Execution using Shared Resource with Improper Synchronization

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...

CVE-2026-13720: Improper Authorization

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

CVE-2026-102111: Improper Validation of Specified Quantity in Input

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative...

ROS-20260930-73-0102

The vulnerability of the hwtracing/intelth/core.c component in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-75823: Improper Privilege Management

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

ROS-20260930-73-0032

The vulnerability of the dma/bcm-sba-raid.c component in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0110

The vulnerability of the drivers/net/can/usb/usb8dev.c component in the Linux kernel is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

RCCL Vulnerability

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-43598| Improper input validation in the AMD ROCm Communication Collectives Library RCCL could allow a compromised peer rank or network-adjacent attacker to dereference an...

CVE-2026-102508: Improper Verification of Cryptographic Signature

Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X PLC4J allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user...

CVE-2026-10726: Improper Certificate Validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

PT-2026-103005

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions prior to 38.2 Pexip Infinity version 39.0 Pexip Infinity version 39.1 Pexip Infinity version 40.0 Description Improper input validation in the media implementation allows a remote attacker to trigger a software abort,...

CVE-2026-47581: Improper Locking

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper locking. A successful exploit of this vulnerability might lead to denial of service...

PT-2026-103392

Name of the Vulnerable Software and Affected Versions NVIDIA GPU Display Driver for Windows and Linux affected versions not specified Description A flaw exists in the kernel mode layer involving improper input validation. This issue could allow an attacker to achieve code execution, denial of...

CVE-2026-103100: Reachable Assertion

Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a denial of service...

PT-2026-103003

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

CVE-2026-103110: Out-of-bounds Write

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node...