EUVD-2026-81480

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...

CVE-2026-91014

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

PT-2026-95010

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains a flaw where the do actual install function in libmport/bundle read install pkg.c utilizes path-based lstat, chown, stat, and chmod operations during package...

PT-2026-94388

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The save file endpoint in the File Manager, used by the Query Tool and ERD, contains a race condition. While the system validates the requested path using the check access permission function, it...

CVE-2026-54576: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall in libmport/bundlereadinstallpkg.c used path-based lstat, chown, stat, and chmod operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlin...

PT-2026-94741

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the bpf netns link update prog function. The issue occurs because checks for old prog and program type are performed without locking before the netns bpf mutex...

The vulnerability of the system file `/cgi-bin/New_GUI/Set/Diagnostics.asp` of the Diagnostics component of the D-Link DSL-3782 microprogramming device allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /cgi-bin/NewGUI/Set/Diagnostics.asp function of the Diagnostics component of D-Link DSL-3782 router microprogramming software is related to the lack of data cleaning measures at the management level when processing the Addr parameter. Exploiting this vulnerability allows ...

CVE-2026-90355: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: clear stale link state on full reset After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996viflinkadd short-circuits when the linkid is still marked in...

CVE-2026-54587: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

CVE-2026-86861: Time-of-check Time-of-use (TOCTOU) Race Condition

pgAdmin 4's File Manager savefile endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.checkaccesspermission and then opened the file for writing with a plain open call. CVE-2026-7819 had previously hardened the separate file upload path by openi...

PT-2026-94494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf and xdp components where bpf xdp link update calls dev xdp install directly, bypassing the checks performed in dev xdp attach. This allows a user to create an...

PT-2026-94837

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC meson component within the meson card reallocate links function. The function uses two consecutive krealloc calls to expand the DAI link and private data...

PT-2026-94698

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt76 wifi driver where the mt76 vif link function indexes the mvif-link array without validating the link id. When callers pass mvif-deflink id or msta-deflink id...

CVE-2026-15815: Improper Link Resolution Before File Access

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

PT-2026-94740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists when reading bpf link information. In the functions bpf link show fdinfo and bpf link get info by fd, the link-prog variable is accessed without proper...

CVE-2026-90350: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinkid, which hold IEEE80211LINKUNSPECIFIED 0xf until the first link has...

PT-2026-95030

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

CVE-2026-82761: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...

PT-2026-94298

Name of the Vulnerable Software and Affected Versions ash authentication versions 3.9.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description A Time-of-check Time-of-use TOCTOU Race Condition occurs when a magic link is configured with single use token?. This allow...

CVE-2026-20309

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...