PT-2026-82264

Name of the Vulnerable Software and Affected Versions smart-web2 version 1.3.1 Description The report module in the backend allows arbitrary SQL execution. This occurs because the sqlResource.sql parameter, processed through the ReportController.save interface and stored in the t report sql...

PT-2026-82363

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...

LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to...

Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...

PT-2026-82371

Name of the Vulnerable Software and Affected Versions CAPTCHA Protected Page versions 0.0.0 through 1.0.2 Description An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to...

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

PT-2026-82172

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the atmel-mci driver due to a race condition in the atmci remove function. The &host-bh work variable is bound to the atmci work func function and can be...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098699)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098699 advisory. In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by socklockinitclassandname and rmmod. When I ran the repro 0 and waited...

Dotnetnuke < 10.3.3 Optional JavaScript restrictions for HTML module content (GHSA-mjq6-87j6-5f4g)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - The HTML module historically allowed trusted content editors to include JavaScript within HTML content. A new security option ha...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098711)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098711 advisory. In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lecarpclearvccs syzkaller reported a null-ptr-deref in...

Linux Distros Unpatched Vulnerability : CVE-2026-80206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied...

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

ROS-20260826-73-0006

The vulnerability of the ath9khifusballoctxurbs function in the drivers/net/wireless/ath/ath9k/hifusb.c module of the Atheros/Qualcomm wireless adapter driver in the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker t...

PT-2026-82374

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Two distinct issues were identified. First, a module designed to restrict access to the /user/login endpoint via a secret key fails to invalidate relevant caches...

PT-2026-82080

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description The tgrep module contains a regular expression denial of service ReDoS issue. The tgrep node action function compiles user-supplied regular expressions within /regex/ pattern nodes and executes them...

PT-2026-82361

Summary An HTML Injection vulnerability exists in the user group creation functionality that allows an attacker to inject arbitrary HTML content into the application interface. The vulnerability occurs when user-supplied input in the group name field is not properly sanitized before being rendere...

PT-2026-82130

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn module where key slots are released through a kref, and the release path frees AEAD Authenticated Encryption with Associated Data transforms from an RCU...