ROS-20260701-73-0048

The vulnerability in the drivers/acpi/acpica/psopcode.c driver of the ACPI framework an extended configuration and power management interface for Linux kernels involves accessing memory beyond the permissible buffer data boundaries due to a violation of the specifications for data transmitted to...

PT-2026-55080

The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat. These file uploads are insufficiently validated before being written to Drupal's temporary directory. In some cases, this may lead to cross-site scripting XSS...

PT-2026-54608

Name of the Vulnerable Software and Affected Versions NVIDIA ConnectX affected versions not specified NVIDIA BlueField affected versions not specified Description A flaw exists in the command interface of the device reachable from a Virtual Function VF context. A local user with VF privileges, su...

PT-2026-54840

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.8 Wagtail versions prior to 7.3.3 Wagtail versions prior to 7.4.2 Description A reflected cross-site scripting XSS issue exists in the dynamic image URL generator view within the admin interface. An attacker with...

PT-2026-55081

The Canvas module allow you to upload image files via a custom API. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file...

PT-2026-54898

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.46.0 MediaWiki versions prior to 1.45.4 MediaWiki versions prior to 1.44.6 MediaWiki versions prior to 1.43.9 Description An issue exists that allows for full account takeover via BotPasswords and OAuth. The flaw ...

Linux driver Max9286 Heap Buffer Overflow DoS

The vulnerability of the functions max9286init and max9286probe in the driver module “drivers/media/i2c/max9286.c” of the Linux operating system’s multimedia device support driver is related to state management errors. Exploiting this vulnerability can allow an attacker to access protected...

Cisco Webex Meetings XSS

The vulnerability of Cisco Webex Meetings software’s web interface is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

PT-2026-54905

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php,...

NETAMS WNAM User Management Authentication Bypass

The vulnerability of NETAMS WNAM wireless network user management software lies in the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to the system’s web interface with administrator privilege...

Oracle Identity Manager (June 2026 CSPU)

The 12.2.1.4.0 or 14.1.2.1.0 version of Identity Manager installed on the remote host is affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory: - Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Easily exploitable...

PT-2026-55225

Name of the Vulnerable Software and Affected Versions FlowDrop versions 0.0.0 through 1.6.0 Description A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently re-evaluate human-in-the-lo...

CVE-2026-56350

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor...

PYSEC-2026-798

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /executejs endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser context with --disable-web-security enabled. An attacker can execute arbitrary...

DEBIAN-CVE-2026-14144

Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-14135

Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14126

Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14133

Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14116

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-14110

Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...