PT-2026-69705

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc2 Description A NULL pointer dereference occurs in the Linux kernel when detaching CCS read/write buffers. This happens because buffers are freed during Buffer Object BO destruction; if BOs are destroyed...

PT-2026-69698

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xe vm create function where a failure in drm gpuvm resv object alloc leads to resource leaks. For non-fault-mode VMs, the xe svm init function succeeds, but xe svm...

CVE-2026-68082

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

EUVD-2026-54775

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

CVE-2026-68082 libceph: fix two unsafe bare decodes in decode_lockers()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers decodelockers in clslockclient.c contains two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. cephdecode32p at the...

CVE-2026-16267

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...

CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...

CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...

EUVD-2026-54729

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...

CVE-2026-16267

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...

CVE-2026-16267

The Newsletters WordPress plugin versions prior to 4.16 is vulnerable to PHP Object Injection . The root cause is the failure to restrict allowed classes when unserialising values received from public form submissions, specifically via a date form field . This allows unauthenticated attackers to ...

CVE-2026-19259 MZ Automation libiec61850 MMS Protocol Workflow iec61850_common.c MmsMapping_varAccessSpecToObjectReference heap-based overflow

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument...

EUVD-2026-54728

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument...

PT-2026-69193

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The decode lockers function in cls lock client.c contains two unsafe decode operations that allow a malicious or compromised Object Storage Device OSD to trigger slab-out-of-bounds reads...

PT-2026-69168

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.16 Description An issue exists where the software fails to restrict the classes allowed during the unserialization of values received from public form submissions. This allows unauthenticated...

CVE-2026-48170

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170 scimPatch vulnerable to prototype pollution via unfiltered keys in patch

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-70561

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

CVE-2026-70561 TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

CVE-2026-70561

TestLink 1.9.20 and earlier is affected by an insecure direct object reference in the attachmentdownload.php endpoint. An authenticated user, including low-privilege guests, can read arbitrary attachments by supplying any integer attachment ID, bypassing per-project access checks. Attackers can e...