CVE-2026-27938 WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the wp-graphql/wp-graphql repository contains a GitHub Actions workflow release.yml vulnerable to OS command injection through direct use of $ github.event.pullrequest.body inside a run: shell block. When a pull request...

PT-2026-22080

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.9.1 Description The WPGraphQL software includes a GraphQL API for WordPress sites. A GitHub Actions workflow file release.yml in the wp-graphql/wp-graphql repository is susceptible to OS command injection. This...

PT-2026-22166

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a stack-based buffer overflow in Payload Utils. The golioth payload as int and golioth payload as float helpers copy network-supplied payload data into fixed-size stack buffers using memcpy with a length derived...

Wireshark Analyzer 4.6.4

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. Thi...

PT-2026-22215

Name of the Vulnerable Software and Affected Versions go2ismail Free-CRM versions prior to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1 Description A flaw exists in go2ismail Free-CRM. This issue impacts an unknown part of the /api/Security/ file within the Security API component, potentially leading...

PT-2026-22195

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0 Description Discourse is an open source discussion platform. A flaw exists in the Data Explorer plugin's access control mechanism...

PT-2026-22131

Name of the Vulnerable Software and Affected Versions Zen C versions prior to 0.4.2 Description A command injection issue exists in the Zen C compiler. Prior to version 0.4.2, a local attacker can execute arbitrary shell commands by providing a specially crafted output filename via the -o...

firefox security update

140.8.0-2.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 140.8.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.8.0-2 - Update to 140.8.0 ESR...

PT-2026-22206

Name of the Vulnerable Software and Affected Versions go2ismail Free-CRM versions prior to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1 Description A flaw exists in go2ismail Free-CRM’s Administrative Interface component that allows for code execution after redirection via remote manipulation. The...

Atheros Wireless DoS

The vulnerability of the ath11kpciprobe function in the drivers/net/wireless/ath/ath11k/pci.c file of the Atheros/Qualcomm wireless adapter driver for the Linux operating system is related to improper resource release. Exploiting this vulnerability could allow an attacker to cause a service failu...

vt6655 Device Init Buffer Overflow DoS

The vulnerability of the deviceinittd0ring function in the drivers/staging/vt6655/devicemain.c file, which supports additional devices in the Linux operating system, is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause service failures...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the dioinit function in the drivers/dio/dio.c module of the Linux kernel is related to improper memory release. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Linux IPv6 Kernel Heap Buffer Overflow DoS

The vulnerability of the ip6mrcachereport function in the net/ipv6/ip6mr.c module of the Linux operating system’s IPv6 kernel implementation is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux kernel serial port module Heap Buffer Overflow DoS

The vulnerability of the jsmprobeone function in the drivers/tty/serial/jsm/jsmdriver.c file of the console TTY driver in the Linux kernel is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a system failure...

Linux kernel bonding buffer overflow DoS

The vulnerability of the bondxdpcheck function in the drivers/net/bonding/bondmain.c file of the Linux kernel’s network device support driver is related to improper resource release. Exploiting this vulnerability could allow an attacker to cause a service failure...

EUVD-2026-8642

zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service...

CVE-2026-27116 Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the filter URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While and are blocked, , ,...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...