CVE-2026-52486

A vulnerability exists in OpenDDS 3.33.x that allows a local attacker to trigger a denial of service (DoS). The root cause is located in the verify function within the SIgnedDocument module . While the specific technical mechanism of the failure is not detailed in the provided documents, the impa...

PT-2026-88518

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4 20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulati...

CVE-2026-16025: Improper Validation of Specified Quantity in Input

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-50093: Unrestricted Upload of File with Dangerous Type

A vulnerability has been identified in Siveillance Control Pro V3.0 All versions V3.0.12.2173, Siveillance Control Pro V4.0 All versions V4.0.9.2178, Siveillance Control V3.0 All versions V3.0.22.2177, Siveillance Control V4.0 All versions V4.0.11.2177. A vulnerability in the OIS web module allow...

RHEL 9 : pam (RHSA-2026:64815)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64815 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...

PT-2026-87528

Name of the Vulnerable Software and Affected Versions Windows MIDI Service Module affected versions not specified Description A stack-based buffer overflow occurs in the Windows MIDI Service Module. This issue allows an authorized attacker to elevate privileges locally on the system. A stack-base...

CVE-2026-79572: Improper Restriction of XML External Entity Reference

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-69339: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally...

EulerOS 2.0 SP12 : cifs-utils (EulerOS-SA-2026-3252)

According to the versions of the cifs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user...

EulerOS 2.0 SP12 : perl-HTML-Parser (EulerOS-SA-2026-3368)

According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. The XS routine backing...

Linux Distros Unpatched Vulnerability : CVE-2026-85484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup,...

CVE-2026-86438

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-86438

Lara Dashboard versions prior to 1.3.2 contain an authorization bypass in the MarketplaceModuleBrowser Livewire component. The installModule action fails to restrict access to Superadmin-level roles, allowing any authenticated non-Superadmin administrator to trigger module installation. Because m...

CVE-2026-86438 Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CLSA-2026-1788816057 rsync: Fix of 5 CVEs

CVE-2026-53784: confine the daemon module-root chdir under "use chroot = no" by resolving the path with a new safeopennoattackersymlinks walk that refuses any symlink component not owned by uid 0 or our euid, so a planted symlink at the module path can no longer redirect the daemon's CWD outside...

CVE-2026-86287

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

The Protocol::HTTP2 Perl module (versions before 1.14 ) is vulnerable to memory exhaustion leading to a denial of service . The root cause is that the stream_state function fails to remove closed streams from the connection stream table, allowing a peer to indefinitely accumulate residual entries...