PT-2026-84053

Name of the Vulnerable Software and Affected Versions hyperledger-firefly versions prior to 1.4.1 Description A server-side request forgery SSRF exists within the Webhook Subscription component. This occurs when the url argument is manipulated in the ValidateOptions function located in the...

PT-2026-83955

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

PT-2026-83902

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

CVE-2026-51691

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Vulnerability of CSS components in Google Chrome and Microsoft Edge web browsers, allowing attackers to access confidential data

The vulnerability of the CSS components in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

The vulnerability of the gncmbind() function in the drivers/usb/gadget/legacy/ncm.c module of the Linux USB device driver allows a hacker to cause a service failure.

The vulnerability of the gncmbind function in the drivers/usb/gadget/legacy/ncm.c module of the Linux USB device driver lies in the pointer manipulation. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

The vulnerability of the check_mem_access() function in the kernel/bpf/verifier.c module, which supports the BPF interpreter of the Linux operating system, allows a hacker to cause a service failure.

The vulnerability of the checkmemaccess function in the kernel/bpf/verifier.c module, which is part of the BPF interpreter support for the Linux operating system’s kernel, relates to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the __acpi_processor_start() function in the drivers/acpi/processor_driver.c file of the ACPI driver (an extended configuration and power management interface) in the Linux kernel allows a attacker to cause a service failure.

The vulnerability of the acpiprocessorstart function in the drivers/acpi/processordriver.c file of the ACPI driver an extended configuration and power management interface for the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a...

CVE-2026-51725

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83929

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Security update for rav1e (low)

openSUSE security update: security update for rav1e ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21681-1 Rating: low References: bsc1249016 Cross-References: CVE-2025-58160 CVSS scores: CVE-2025-58160 SUSE : 3.1...

PT-2026-83751

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An issue exists where the software fails to validate if authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints. This allows any user...

PT-2026-83956

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf string new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made...

CVE-2026-51713: Improper Access Control

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-82589

A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amfnamfcommhandlen1n2messagetransfer of the file src/amf/namf-handler.c of the component N1-N2 Message Handler. Performing a manipulation of the argument...

CVE-2026-82590 Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion

A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...

CVE-2026-82590 Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion

A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...

CVE-2026-82553

This vulnerability affects sambitraj Student Management System (up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5). The Student Dashboard component, specifically the mysqli_query function in student_dashboard.php, is vulnerable to improper authorization through manipulation of the roll_no arg...

CVE-2026-82553 sambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization

A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqliquery of the file studentdashboard.php of the component Student Dashboard. The manipulation of the argument rollno results in improper...