CVE-2026-89177 Howyar｜WeenyGenius - Use of Insecure Protocol

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

appsandbox v0.1.5

App Sandbox App Sandbox is a virtual machine app for Windows and macOS that's focused on performance and ease of use. Windows features: Works on Windows 11 Home or Pro, without Hyper-V Windows 11 or Ubuntu 26.04 LTS VM Support Zero touch install Copy and Paste 2 Channel Audio GPU Acceleration via...

CVE-2026-19985

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray...

ffuf v2.3.0

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

PT-2026-90523

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An improper access control issue exists in a deployment mode designed to provide read-only access to a bundled packet-analysis component's interface. The system...

PT-2026-89800

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

PT-2026-96604

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN ON ONCE from nfsd mode check The header for commit e75b23f9e323 "nfsd: check d can lookup in fh verify of directories" details the assumption that justified adding the WARN ON ONCE to nfsd mode check, tha...

PT-2026-90281

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Linux kernel when using ipip or mplsip tunnels in collect md mode. The issue arises within the ipip tunnel rcv function when ip tun rx dst fails to allocate...

PT-2026-96556

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect md mode when metadata dst allocation fails In collect md mode ipip tunnel rcv returns 0 without freeing the skb when ip tun rx dst fails to allocate the metadata dst. ipip rcv and mplsip rcv are...

PT-2026-90427

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Network File System Daemon NFSD where the nfsd mode check function contains a flawed WARN ON ONCE macro. In scenarios involving NFS reexport, the function may...

PT-2026-90354

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the setuid or setgid bits are not properly cleared on the server when a file is written to. While the Virtual File System VFS strips these bits an...

PT-2026-89753

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi debug...

CVE-2026-89565: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

CVE-2026-89177: Selection of Less-Secure Algorithm During Negotiation

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to...

PT-2026-96527

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl op mode dvm start In iwl op mode dvm start, jumping to out free eeprom currently bypasses the out free eeprom blob label. Consequently, error paths triggered after successfully parsing t...

ROS-20260911-73-0178

The vulnerability of the Guest mode in Google Chrome browser is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to carry out spam attacks using a specially created HTML page...

PT-2026-90461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in debugfs where the lockdown check was not updated to include the mmap prepare file operation. This occurs because the relayfs was updated to use mmap prepare instead of...

CVE-2026-89745: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmapprepare Commit 651fdda8406d "relay: update relay to use mmapprepare" changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly...

GO-2026-6374 SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent publish mode: reader-reachable raw SQL method 2 and unescaped REGEXP method 3 on read-write asset-content DB in github.com/siyuan-note/siyuan/kernel...

GO-2026-6408 SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) in github.com/siyuan-note/siyuan/kernel

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification publish mode in github.com/siyuan-note/siyuan/kernel...