CVE-2026-75161

MBS-Solutions X-Serie Gateway firmware V6_00_05 is vulnerable to arbitrary code injection via the ugw-restart method in /cgi-bin/wwwugw.cgi. A remote authenticated user with the low-privileged Standard role can inject code into the dpcheck system utility, which executes as root , leading to full ...

EUVD-2026-71445

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

PT-2026-85611

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hid hw stop on probe failure nintendo hid probe calls hid device io start before joycon init and joycon leds create. If either fails, the error path jumps to err close which calls hid hw...

The vulnerability of the AbstractAggregateConnection::write() method in PHP clients for Redis and Valkey Predis databases allows attackers to execute arbitrary commands and cause service failures.

The vulnerability of the AbstractAggregateConnection::write method in PHP clients for Redis and Valkey Predis lies in the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows an attacker to execute arbitrary commands and cause service failures...

The vulnerability of the DOMHandler.startElement() method in the lib/dom-parser.js file of the XML document access and manipulation module XMLDOM allows a attacker to trigger a denial-of-service attack.

The vulnerability of the DOMHandler.startElement method in the lib/dom-parser.js file of the XML document access and manipulation module called XMLDOM is related to algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Unbreakable Enterprise kernel security update

6.12.0-206.104.3.3 - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974840 CVE-2026-80590 6.12.0-206.104.3.2 - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs Weiming Shi Orabug: 39931938 CVE-2026-74517 - tcp: challenge ACK for non-exact...

EUVD-2026-71446

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

Linux Distros Unpatched Vulnerability : CVE-2026-80770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: nintendo: stop device IO before hidhwstop on probe failure nintendohidprobe calls hiddeviceiostart before joyconinit and joyconledscreate. If either fails,...

Linux Distros Unpatched Vulnerability : CVE-2026-80855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-106202)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106202 advisory. FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in...

PT-2026-85455

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-75163

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

CVE-2026-75168

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

CVE-2026-75168

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

Unbreakable Enterprise kernel security update

5.15.0-324.217.5.2 - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974835 CVE-2026-80590 5.15.0-324.217.5.1 - crypto: qat: restore misc workqueue lifecycle Manjunath Patil Orabug: 39937535 - LTS version: v5.15.217 Vijayendra Suman - ring-buffer: Use...

PT-2026-85808

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

PT-2026-85682

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

CVE-2026-75167

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

UBUNTU-CVE-2026-80734

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

Linux Distros Unpatched Vulnerability : CVE-2026-85152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a...