CVE-2026-72204

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability arises from insufficient validation of the $INDEXROOT header, which is crucial for managing directory and file indexes. An attacker could potentially craft a specially malformed NTFS file system. Processing this...

CVE-2026-46482 MyBB: Security Question insufficient validation

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-46482 MyBB: Security Question insufficient validation

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-46482 MyBB: Security Question insufficient validation

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-46482

MyBB's registration flow (member.php?action=do_register) accepts a hidden question_id field and validates the Security Question answer without a fail-closed fallback. A blank, forged, or expired question_id lets the request proceed, enabling CAPTCHA bypass for automated account creation. CVSS 3.1...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-72199

A flaw was found in the NTFS filesystem driver of the Linux kernel. This vulnerability arises from insufficient validation of resident index root values during lookup operations. An attacker could potentially craft a malicious NTFS filesystem that, when processed by the kernel, leads to...

tailscale -- Insufficient validation of 4via6 subnet router destinations

Tailscale team reports: Insufficient validation of 4via6 subnet router destinations permitted access to host-scoped addresses, including cloud metadata and loopback services. TS-2026-11...

CVE-2026-9816

Mattermost 11.7.x (≤11.7.6), 10.11.x (≤10.11.21), and 11.8.x (≤11.8.3) lack server-side validation of BoardMember.Scheme* fields on insert and archive-import paths, allowing board editors or non-guest team members to grant Board Admin to arbitrary users via POST /api/v2/boards/{boardID}/members a...

CVE-2026-72303

A flaw was found in the ASoC Sound Open Firmware SOF ipc4-control component of the Linux kernel. This vulnerability arises from insufficient validation of the MODULENOTIFICATION payload length when handling control updates. An attacker could potentially exploit this by providing a malformed...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

Linux driver pci endpoint DoS

The vulnerability in the drivers/pci/endpoint/pci-ep-cfs.c component of the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-19711 Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...

EUVD-2026-59914

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator m...

EUVD-2026-59784

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-72206

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

PT-2026-72141

Name of the Vulnerable Software and Affected Versions RapiSafe – Secure Multi File Upload for Contact Form 7 versions prior to 1.0.5 Description Insufficient file path validation in the handleAjaxRemoveUpload function allows unauthenticated attackers to delete arbitrary files on the server. This...

CVE-2026-58224

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequa...

CVE-2026-58224

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequa...

CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...