Linux Distros Unpatched Vulnerability : CVE-2026-80847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: clamp route advmss to TCPMINMSS tcpselectinitialwindow assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate...

PT-2026-86167

PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response update service route in pjsua acc.c. This affects applications that register using the...

PT-2026-85725

In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCP MIN MSS tcp select initial window assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAX ADVMSS is one way to g...

CVE-2026-85435

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRYSHOREHOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and...

CVE-2026-85434 MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODEBROKERPING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses...

CVE-2026-85434 MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODEBROKERPING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses...

CVE-2026-85435

MOOS-IvP uFldNodeBroker (through version 24.8.1) fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus. This allows any publisher to enroll attacker-controlled shore routes, enabling an attacker to receive bridged vehicle traffic including sensor data and control information ...

CVE-2026-85435 MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRYSHOREHOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and...

CVE-2026-85435 MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRYSHOREHOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and...

CVE-2026-85434

MOOS-IvP uFldShoreBroker through version 24.8.1 contains a bridge route injection vulnerability. The component fails to verify node ping authenticity before creating outbound bridge routes, allowing an attacker on the network to publish NODE_BROKER_PING messages with crafted HostRecord data and r...

CVE-2026-85433

MOOS essential-moos pShare component (versions through 10.0.1 ) fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted messages with cmd=output or cmd=input to open new listeners on arbitrary addre...

CVE-2026-85433 MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARECMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARECMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary address...

grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

PT-2026-85284

Name of the Vulnerable Software and Affected Versions MOOS-IvP uFldNodeBroker versions prior to 24.8.2 Description The uFldNodeBroker fails to validate the source of TRY SHORE HOST messages on the vehicle bus. This allows any publisher to enroll shore routes controlled by an attacker, enabling th...

EUVD-2026-42744

Siyuan: Authenticated path traversal in /snippets/ static handler serveSnippets leaks conf/conf.json secrets and siyuan.db...

CVE-2026-78153 Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

CVE-2026-78153

The Restrict User Access WordPress plugin versions before 2.8.1 fail to normalise the REST API route before comparing it against protected routes. This route normalization flaw allows unauthenticated attackers to bypass content protection, read restricted content, and enumerate users via the REST...

EUVD-2026-70042

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

CVE-2026-81199 MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...