ROS-20260916-73-0087

The vulnerability of the atmelhlcdcplaneatomicduplicatestate function in the drivers/gpu/drm/atmel-hlcdc/atmelhlcdcplane.c driver of the Direct Rendering Infrastructure DRI infrastructure of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this...

The vulnerability of the OUD Core component of the Oracle Unified Directory application, which facilitates simplified deployment of the Oracle Fusion Middleware software. This vulnerability allows a malicious individual to gain full control over the application.

The vulnerability of the OUD Core component of the Oracle Unified Directory application, a simplified deployment solution for the Oracle Fusion Middleware software platform, is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker ...

The vulnerability of the Messaging Enabler component of the Service Delivery Platform software, a component of the Oracle Fusion Middleware software platform, allows a perpetrator to gain full control over the application.

The vulnerability of the Messaging Enabler component of the Service Delivery Platform software, part of the Oracle Fusion Middleware software platform, is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to...

ROS-20260916-73-0011

The vulnerability of the systimerdelete function in the kernel/time/posix-cpu-timers.c file of Linux operating systems is related to situations where there is a race condition in the signal handler. Exploiting this vulnerability can allow an attacker to enhance their privileges and disclose...

The vulnerability of the group_is_primary() function in the FreeBSD operating system allows a hacker to increase their privileges.

The vulnerability of the groupisprimary function in the FreeBSD operating system’s kernel involves bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a remote attacker to gain increased privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-89959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfio-ap: Fix control domain removal in vfioapmdevcfgremove The vfioapconfigremove function uses the bitmapandnot function to clear bits from the...

Linux Distros Unpatched Vulnerability : CVE-2026-91091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the...

Linux Distros Unpatched Vulnerability : CVE-2026-91088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler...

Linux Distros Unpatched Vulnerability : CVE-2026-89896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: cedrus: fix memory leak in cedrusinitctrls In cedrusinitctrls, the V4L2 control handler is initialized before allocating memory for ctx-ctrls. If this...

ROS-20260916-73-0003

The vulnerability of the nftmapcatchallactivate function in the nftables component of the Linux kernel lies in the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the sub_452CCC() function in D-Link DWR-M960 router microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the sub452CCC function in D-Link DWR-M960 router microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure...

CVE-2026-92363: Uncontrolled Resource Consumption

A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sseparser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called...

PT-2026-93255

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web core/src/v0 9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The...

PT-2026-93228

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web core/src/v0 9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible...

ROS-20260916-73-0071

The vulnerability of the xfrmstatedelete function in the net/xfrm/xfrmstate.c module, which is part of the Linux kernel’s networking functions, relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-61590: Missing Authentication for Critical Function

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CVE-2026-92360: Origin Validation Error

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...

CVE-2026-92579: Authentication Bypass by Alternate Name

In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...

CVE-2026-92576: Server-Side Request Forgery (SSRF)

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...

CVE-2026-89034: Missing Authentication for Critical Function

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...