CVE-2026-92916: Exposure of Sensitive Information to an Unauthorized Actor

Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...

CVE-2026-25281: Allocation of Resources Without Limits or Throttling

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...

PT-2026-94147

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A transient Denial of Service DoS occurs due to insufficient memory allocation validation when processing large or numerous request buffers. This issue can lead ...

PT-2026-94417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto acomp component where ACOMP REQUEST ON STACK reserves insufficient storage for asynchronous fallbacks. When an async implementation is selected, the acomp...

PT-2026-94157

Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...

PT-2026-94520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the smbdirect component of the Linux kernel where memory pools are destroyed before the Queue Pair QP during an accept failure. In the rdma accept failed error path of...

PT-2026-95097

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An unauthenticated pull-request author can modify the NETBOX DT LIBRARY URL constant in tests/test configuration.py before the validation test harness executes. During pyte...

CVE-2026-86049: Insertion of Sensitive Information into Log File

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

Fedora 45 : python-django5 (2026-950089270f)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-950089270f advisory. Update python-django5 to the latest 5.x release 5.2.17 - Fixes CVE-2026-15307 high: Server-side file-write and request forgery via spatial lookups -...

AlmaLinux 10 : libevent (ALSA-2026:67909)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67909 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...

Eclipse Jetty HTTP Request Processing

The vulnerability of Eclipse Jetty servlet containers is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to carry out attacks by substituting HTTP requests...

PT-2026-95159

Name of the Vulnerable Software and Affected Versions Prebid Server Java versions prior to 3.43.0 Description Certain bidder adapters interpolate user-supplied parameters into outbound request URLs without utilizing HttpUtil to validate the resulting domain or path segment. This allows a maliciou...

EUVD-2026-82467

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...

PT-2026-94523

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the SMB server component of the Linux kernel. The issue arises when the buffer returned by the ksmbd ipc login request ext function is not properly freed after...

PT-2026-94691

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cfg80211 module where PMSR Passive Measurement Service Request request teardown fails to abort active measurements before the wireless dev is removed from the driv...

CVE-2026-90343: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wirelessdev is still present in the driver. cfg80211leavelocked and cfg80211stoppd already do this before invoki...

PT-2026-94518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd component where the ipc validate msg function computes the expected message size by reading length fields from a response buffer supplied by the userspace...

PT-2026-94336

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions prior to 0.17.1 Description A reachable assertion issue exists in the DistServe decode migration loop. An unauthenticated attacker can terminate the inference engine by submitting a migration request containing an...

CVE-2026-54670: Improper Limitation of a Pathname to a Restricted Directory

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

RockyLinux 8 : libevent (RLSA-2026:67908)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67908 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...