CVE-2026-75414

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability...

CVE-2026-77535: Improper Input Validation

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

CVE-2026-80573: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

PT-2026-82071

Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a malicious actor with network access and low privileges to perform command injection on the host device. Command injection is a fl...

PT-2026-82075

Name of the Vulnerable Software and Affected Versions UniFi Enterprise Audio/Video Bridge affected versions not specified Description An improper input validation issue allows a network-based actor to perform command injection on the device. Command injection is a flaw where an attacker can execu...

PT-2026-82335

Name of the Vulnerable Software and Affected Versions super-diamond-server versions prior to 1.3.4 Description The front-end interface '/superdiamond/preview/projectCode/module/type' is susceptible to SQL injection. This occurs because the module parameter is directly concatenated into a SQL IN...

PT-2026-82070

Name of the Vulnerable Software and Affected Versions UniFi Access Application affected versions not specified Description An improper input validation issue allows a malicious actor with network access and low privileges to perform command injection on the host device. Command injection is a fla...

PT-2026-82085

Name of the Vulnerable Software and Affected Versions UniFi Talk Application versions prior to 5.3.2 Description An improper input validation flaw allows a malicious actor with network access to execute a command injection on the host device. This issue enables the execution of operating system...

PT-2026-81956

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-82062

Name of the Vulnerable Software and Affected Versions UniFi Access Application affected versions not specified Description An improper input validation issue allows a malicious actor with network access and low privileges to perform command injection on the host device. Command injection is a...

Linux Distros Unpatched Vulnerability : CVE-2026-79076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic...

Linux Distros Unpatched Vulnerability : CVE-2026-79151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-79008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to...

Linux Distros Unpatched Vulnerability : CVE-2026-79000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in DeviceBoundSessionCredentials in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to...

Linux Distros Unpatched Vulnerability : CVE-2026-79214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web...

Linux Distros Unpatched Vulnerability : CVE-2026-79015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted...

PT-2026-82191

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cs40l50 add function where custom data from an FF PERIODIC or FF CUSTOM effect is copied from user space via EVIOCSFF without sufficient validation of the custom l...

Linux Distros Unpatched Vulnerability : CVE-2026-79105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a craft...

PT-2026-81978

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon box 2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2026-13480: Improper Input Validation

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...