CVE-2025-13826: Improper Input Validation

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is...

PT-2026-33922

Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by sending malicious requests. If the vulnerability is...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-010845)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010845 advisory. In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator switch when reinitializing queues The hctx's runwork may be racing...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-011310)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011310 advisory. In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix deadlock issue when externellb and reset are executed together When externellb and...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006964)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006964 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to sockput when msg has moredata In tcpbpfsendverdict redirectio...

PT-2026-34306

Name of the Vulnerable Software and Affected Versions Sendmachine for WordPress versions prior to 1.0.21 Description An authorization bypass exists due to improper verification of user permissions within the manage admin requests function. This flaw allows unauthenticated attackers to overwrite t...

PT-2026-34172

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By...

Zervit 输入验证错误漏洞

Zervit is an open-source HTTP/Web server developed by Zervit. Zervit has a vulnerability related to input validation. This vulnerability arises due to insufficient input validation during configuration reset requests, which may lead to a remote denial-of-service attack, causing the application to...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013047)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013047 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011135)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011135 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has...

CVE-2026-40905: URL Redirection to Untrusted Site

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By...

PT-2026-34022

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password reset at timestamp. However, the token redemption function findUserIDFromEmailAndToken queries only for a matching...

blueprintUE self-hosted edition 安全漏洞

The blueprintUE self-hosted edition is an open-source data modeling and visualization tool developed by blueprintUE. Versions prior to blueprintUE self-hosted edition 4.2.0 contained security vulnerabilities. These vulnerabilities stemmed from the password reset token generation process, where th...

CVE-2026-40587: Insufficient Session Expiration

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither operation invalidates existing authenticated sessions for that user. A server-side session store...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011000)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011000 advisory. In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rdstcpresetcallbacks syzbot is reporting...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011254)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011254 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix epfile null pointer access after ep enable. A race condition occurs when...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010911)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010911 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: cake: fix null pointer access issue when cakeinit fails When the default qdisc is cak...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013089)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013089 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix epfile null pointer access after ep enable. A race condition occurs when...

CVE-2026-6493

A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/locale/auth/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site...

CVE-2026-24468

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11.0 and prior to version 2.0.13, the /api/reset endpoint behaves differently depending on whether the supplied username exists in the syste...