PT-2026-34178

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $ POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not...

Oracle Financial Services Analytical Applications Infrastructure 安全漏洞

Oracle Financial Services Analytical Applications Infrastructure is a financial data analysis and modeling platform developed by Oracle Corporation. There is a security vulnerability in Oracle Financial Services Analytical Applications Infrastructure, which stems from issues with the Platform...

Oracle Enterprise Manager Base Platform 安全漏洞

Oracle Enterprise Manager Base Platform is a local management platform developed by Oracle Corporation in the United States. This platform is primarily used for managing the deployment of Oracle products. Versions 13.5 and 24.1 of Oracle Enterprise Manager Base Platform contain security...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013374)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013374 advisory. In the Linux kernel, the following vulnerability has been resolved: ipmi: fix use after free in ipmidestroyuser The intffree function frees the intf pointer so we...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011035)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011035 advisory. In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp Simplify platform device handling Coretemp's platform driver is unconventional. A...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006971)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006971 advisory. In the Linux kernel, the following vulnerability has been resolved: irqchip: Fix refcount leak in platformirqchipprobe ofirqfindparent returns a node pointer with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010913)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010913 advisory. In the Linux kernel, the following vulnerability has been resolved: platform/chrome: fix memory corruption in ioctl If smem.bytes is larger than the buffer size it...

CVE-2026-33813: Undefined Security Weakness

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms...

PT-2026-34079

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7.9 Oracle Financial Services Analytical Applications Infrastructure versions 8.0.8.7 Oracle Financial Services Analytical Applications Infrastructure versions 8.1.2...

Security Bulletin: NVIDIA KAI Scheduler - April 2026

NVIDIA has released a software update for NVIDIA® KAI Scheduler. To protect your system, clone or update this software to KAI Scheduler v0.13.0 or later from the KAI-Scheduler GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that thi...

PT-2026-34206

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.1 Description An issue exists where the isValidDuration function at 'objects/video.php:918' uses a regular expression /^0-91,2:0-91,2:0-91,2/ that lacks a $ end anchor. This allows arbitrary HTML or JavaScript ...

WWBN AVideo 安全漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 29.0 contained security vulnerabilities. These vulnerabilities stemmed from incomplete XSS repairs in the ParsedownSafeWithLinks class, as well as the lack of coverage for...

WWBN AVideo 路径遍历漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained a path traversal vulnerability. This vulnerability stemmed from the directory traversal fix in objects/aVideoEncoderReceiveImage.json.php, which only checked the U...

PT-2026-34204

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description An incomplete fix in the CloneSite feature allows for the deletion of arbitrary files. The deleteDump parameter in a GET request does not properly filter path traversal sequences, such as ../.....

WWBN AVideo 访问控制错误漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained an access control vulnerability. This vulnerability stemmed from incomplete CORS origin validation repairs, as two code paths still reflected arbitrary Origin...

WWBN AVideo 安全漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 29.0 contained security vulnerabilities. These vulnerabilities stemmed from the objects/getCaptcha.php file, which directly accepts the CAPTCHA length from the query string...

PT-2026-34052

Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level commentable field in the API allows access to all commentable resources within the platform, without any permission checks. All Decidim instances are impacted that hav...

CVE-2026-34310: Improper Access Control

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications component: Platform. Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2026-34279: Missing Authentication for Critical Function

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Event Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006989)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006989 advisory. In the Linux kernel, the following vulnerability has been resolved: perf/smmuv3: Fix hotplug callback leak in armsmmupmuinit armsmmupmuinit won't remove the callback...