EUVD-2026-76925

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

PT-2026-91278

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 3.7.17 October CMS versions prior to 4.2.21 Description The backend SessionMaker trait stores widget session state using base64serialize... and processes it with the unserialize function without an allowed classes...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90647

ASE/Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 (Windows) contains an improper certificate validation vulnerability in its IEC 60870-5-104 TLS client (Task Mode). A network-positioned attacker can bypass certificate validation by presenting a certificate with multiple s...

SUSE CVE-2026-89565

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

EUVD-2026-76739

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

Linux Distros Unpatched Vulnerability : CVE-2026-89745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d relay: update relay to use mmapprepare changed the mmap file operation to mmapprepare for relayf...

Linux Distros Unpatched Vulnerability : CVE-2026-80948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label...

PT-2026-90730

Name of the Vulnerable Software and Affected Versions Socket Firewall socketdev/socket-registry-firewall versions prior to 2.0.0 Description In registry mode, the software fails to verify upstream TLS certificates by default. When the api ssl verify and upstream ssl verify configuration keys are...

Linux Distros Unpatched Vulnerability : CVE-2026-89565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails t...

CVE-2026-89745

A flaw was found in the Linux kernel's debugfs component. The lockdown mechanism, designed to enhance system integrity, did not properly account for files using the mmapprepare operation. This oversight could allow an attacker to bypass kernel lockdown restrictions when the system is operating in...

CVE-2026-89738

A flaw was found in the Linux kernel's at91udc USB gadget driver. In polled-VBUS mode, a timing issue during driver unbinding or probe failure can lead to a use-after-free vulnerability. A local attacker could exploit this by triggering a normal driver unbind operation, which may interleave with ...

CVE-2026-90454

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90448

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...

CVE-2026-50013

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...

CVE-2026-90454

A read-only deployment mode for a product with a bundled packet-analysis component (per the CISA ICS-CERT advisory reference) uses a pattern-based deny list to block write-capable routes, but the pattern omits routes that modify tags on stored session records . Since the proxy otherwise permits t...

CVE-2026-90454 Missing authorization in Malcolm

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90448 Missing Authorization in Malcolm

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...

CVE-2026-90448 Missing Authorization in Malcolm

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...