CVE-2026-82869 ToolJet Database before v3.16.44 Privilege Escalation via join_tables

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

EUVD-2026-68404

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-82869

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint. The endpoint grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation , allowing an attacker to read arbitrary tables from any workspace...

CVE-2026-75458

The XueZhiSi Open Source Exam System versions

PT-2026-83524

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging versions prior to 0.9.133 Description The backup restoration process fails to properly validate the destination paths of files extracted from a backup package. This creates a Zip Slip condition, which is a...

CVE-2026-82462

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

PT-2026-83414

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.40 Description An issue exists where the plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows...

PT-2026-83393

Name of the Vulnerable Software and Affected Versions Rest Routes WordPress plugin versions prior to 5.5.6 Description An issue exists where a value taken from the URL of a public REST route is not properly sanitized or validated before being used in a SQL query. This allows unauthenticated...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001397)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001397 advisory. In the Linux kernel, the following vulnerability has been resolved: slip: make slhcremember more robust against malicious packets syzbot found that slhcremember was...

CVE-2026-55068

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

SUSE CVE-2026-72114

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-80624

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...

CVE-2026-80592

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top of struct damonregion clearly says that For any use case, @ar should be non-zero positive size. which is now verified in...

UBUNTU-CVE-2026-80591

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fslistxattr. Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a...

CVE-2026-80722

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

CVE-2026-80674

CVE-2026-80674 is a critical (CVSS 9.8) vulnerability in the Linux kernel NTFS driver . The ntfs_read_locked_inode() function copies a resident $ATTRIBUTE_LIST into the inode's attribute list via a plain memcpy() with no validation . Subsequent attribute-list walks (ntfs_external_attr_find(), ntf...

CVE-2026-80624 mfd: cs42l43: Sanity check firmware size

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...

CVE-2026-80595

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...

CVE-2026-80595 Input: ims-pcu - add response length checks

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...

CVE-2026-80592 samples/damon/mtier: fail early if address range parameters are invalid

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top of struct damonregion clearly says that For any use case, @ar should be non-zero positive size. which is now verified in...