PT-2026-61233

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the wacom hid set device mode function. The issue occurs because the function assumes the HID DG INPUTMODE usage is always located in the first field...

PT-2026-61232

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap read occurs during HCP header parsing. The functions nfc hci recv from llc and nci hci data received cb access packet-header from skb-data without verifying that th...

PT-2026-61151

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the batman-adv module when a hard interface is disabled. While the worker is disabled via batadv hardif disable interface and batadv v ogm iface disable, and the...

PT-2026-61234

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vti6 changelink function where the kernel fails to correctly handle network namespace changes for vti6 devices. When a vti6 tunnel is moved to a different network...

CVE-2026-16129

The CVE-2026-16129 entry concerns princezuda SafestClaw (Built-in Web Interface) with a flaw in ShellAction._validate_command in src/safestclaw/actions/shell.py of the Built-in Web Interface. The vulnerability is described as an incomplete blacklist in the command validation logic, enabling local...

EUVD-2026-45390

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16129 princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-11826

OpenPLCv3 contains a heap-based buffer overflow in the getData function in webserver/core/modbusmaster.cpp. getData reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig the function is invoked with the 100-byte...

CVE-2026-11826

OpenPLC_v3 has a heap-based buffer overflow in getData() within webserver/core/modbus_master.cpp. getData() copies data between delimiters into a caller-supplied buffer without size/bounds checks. parseConfig() uses a 100-byte heap-allocated MB_device.dev_name; an authenticated user can POST an o...

CVE-2026-16076

AstrBot up to version 4.25.5 is affected by CVE-2026-16076. The vulnerability occurs in OpenApiRoute.chat_send (astrbot/dashboard/routes/open_api.py) where manipulation of the Username argument leads to authentication bypass by spoofing. The issue is exploitable remotely, the exploit is publicly ...

PT-2026-60919

Name of the Vulnerable Software and Affected Versions AstrBot versions prior to 4.25.6 Description An authorization bypass exists in the session-listing endpoint. The issue resides in the OpenApiRoute.get chat sessions function within the astrbot/dashboard/routes/open api.py file. A remote attack...

PT-2026-60977

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction. validate command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

Oracle Linux 8 : perl-DBI:1.641 (ELSA-2026-38901)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-38901 advisory. - Fix stack overflow and buffer overflow in DBI.xs CVE-2026-9698 Resolves: RHEL-184974 - Fix stack overflow and buffer overflow in DBI.xs CVE-2026-9698 Resolve...

CVE-2026-16129: Incomplete List of Disallowed Inputs

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

PT-2026-60921

Name of the Vulnerable Software and Affected Versions AstrBotDevs AstrBot versions prior to 4.25.6 Description An authentication bypass exists in the API component due to username spoofing. A remote attacker can manipulate the Username argument within the OpenApiRoute.chat send function located i...

CVE-2026-8056

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the applytweaks function...

GO-2026-5961 SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist in github.com/siyuan-note/siyuan/kernel...

GO-2026-5969 TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation in github.com/almeidapaulopt/tsdproxy...

CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

CVE-2026-8056

Summary: IBM Langflow OSS 1.0.0–1.10.0 contains a parameter injection vulnerability in the API Graph Execution Engine. A flaw in the parameter filtering logic in the apply_tweaks() function allows authenticated users to override component parameters at runtime via the tweaks API, potentially exec...