PT-2026-117064

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

CVE-2026-98821: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

PT-2026-117040

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB HAS METADATA leaves iocb-private as a uio meta, while iocb bio iopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdev direct IO, which never publishes...

CVE-2026-111907

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

CVE-2026-111907

The software phpMyFAQ versions 4.0.0 before 4.1.9 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in the POST /admin/api/update-database endpoint. The root cause is the lack of CSRF token validation when executing database migrations. An attacker can trick a logged-in user poss...

EUVD-2026-103313

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

Linux Kernel Security Vulnerabilities

The Linux kernel versions 6.16.8 to 6.17 contain security vulnerabilities. These vulnerabilities arise when user integrity metadata is combined with direct I/O polling. In this scenario, IOCBHASMETADATA reserves iocb-private as uiometa, while iocbbioiopoll treats it as bio. This leads to calls to...

CVE-2026-111907: Cross-Site Request Forgery (CSRF)

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...

CVE-2026-76182

A flaw was found in Eclipse Jetty. When configured to forward requests to template Uniform Resource Identifiers URIs using TryPathsHandler or TryFilesFilter, path values are not properly encoded before substitution into query strings. A remote attacker can exploit this flaw by sending requests...

CVE-2026-109813

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

CVE-2026-109813 Shared Hard-coded Root CA Private Key

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

EUVD-2026-102594

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

CVE-2026-109813

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman component of certain Moxa industrial computing products . An unauthenticated attacker with adjacent network access can exploit the exposed private key material to compromise the confidentiality and integrity of communicati...

Cryptographic Failure org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Cryptographic Failure vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2,...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bcprov-lts8on Dependency in Jira Service Management Data Center

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Cryptographic Failure vulnerability was introduced in versions 10.3.0 and 11.3.0 of Jira Service Managemen...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bcprov-lts8on Dependency in Jira Software Data Center

This is a vulnerability in a non-Atlassian Jira Software Data Center dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Cryptographic Failure vulnerability was introduced in versions 10.3.0 and 11.3.0 of Jira Software Data...

Cryptographic Failure org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcprov-jdk18on Dependency in Crucible Server

This High severity Cryptographic Failure vulnerability was introduced in version 4.9.0 of Crucible Server. This Cryptographic Failure vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated attacker to expose assets in yo...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Crucible Server

This High severity Cryptographic Failure vulnerability was introduced in version 4.9.14 of Crucible Server. This Cryptographic Failure vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber allows an unauthenticated...