PT-2026-68437

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description The user self-signup flow fails to adequately validate user-supplied input, allowing arbitrary unvalidated data to be included within user claims. These claims are subsequently used by...

PT-2026-68634

Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.0 Description An issue exists where the software fails to validate user-supplied price values against the actual product price when items are added to the cart via public REST API endpoints. This...

PT-2026-68647

Name of the Vulnerable Software and Affected Versions Easy Booking WordPress plugin versions prior to 3.5.0 Description The plugin fails to enforce the configured minimum booking duration on the server side during the process of adding a product to the cart and calculating the booking price. This...

PT-2026-68678

Name of the Vulnerable Software and Affected Versions libiec61850 versions prior to 1.6.2 Description A use after free issue exists in the URCB Revalidation component within the deleteDataSetValuesShadowBuffer function located in the src/iec61850/server/mms mapping/reporting.c file. This flaw...

ROS-20260806-73-0009

The vulnerability of the smcibissgneedsync function in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-16067: External Control of Assumed-Immutable Web Parameter

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-10524: External Control of Assumed-Immutable Web Parameter

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...

PT-2026-68521

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime Utility versions 1.6.0 through 1.6.3 Description An SQL Injection issue exists in the apr dbd oracle provider. This occurs due to the improper neutralization of special elements used in an SQL command, which could allow...

CVE-2026-16734: Missing Authorization

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2024-10302: Improper Input Validation

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various...

PT-2026-68401

Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.2 Description An issue exists where the plugin fails to verify if the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions. This allows an...

ROS-20260806-73-0013

The vulnerability of the teeshmput function in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

ROS-20260806-73-0008

The vulnerability of the listfirstentry function in the Linux operating system’s kernel is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

X86 device driver framework DoS

The vulnerabilities of the functions cmpcaccelsensitivityshowv4 and cmpcaccelsensitivitystorev4 in the driver/platform/x86/classmate-laptop.c file of the Linux operating system’s X86 kernel device driver are related to pointer manipulation. Exploiting these vulnerabilities could allow an attacker...

acpi_processor_errata_piix4 Heap Buffer Overflow DoS

The vulnerability of the acpiprocessorerratapiix4 function in the drivers/acpi/acpiprocessor.c file of the ACPI driver for the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2026-64654: Improper Neutralization of Escape, Meta, or Control Sequences

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the bcmvkread function in the drivers/misc/bcm-vk/bcmvkmsg.c file of the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

EulerOS 2.0 SP13 : dnsmasq (EulerOS-SA-2026-3013)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS...

EulerOS 2.0 SP13 : dnsmasq (EulerOS-SA-2026-2963)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS...

MiracleLinux 9 : unbound-1.24.2-3.el9_8.2 (AXSA:2026-1474:09)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1474:09 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...