PT-2026-72149

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System versions prior to 3.2.37 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can wri...

PT-2026-72844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB array access occurs in the ath tx edma tasklet function. The function accesses sc-tx.txqts.qid, where ts.qid is a 4-bit hardware field with a range of 0 to 15...

PT-2026-72873

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the uvcvideo module when a UVC camera utilizes an asynchronous control. The issue arises when the uvc status stop function is called from async ctrl.work through the...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext-vscode is a Theia - Plugin Extension for VsCode Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute...

MINI-HPX3-4PVV-WF6P

Bulletin has no description...

WordPress TLP Food Menu plugin < 6.0.2 - Unauthenticated Reservation Status Modification vulnerability

Unauthenticated Reservation Status Modification vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions 6.0.2...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: ocm-cli, trivy-operator, vcluster-fips, drone-fips, helm-operator, helm-push, rancher-agent, xeol, zarf-fips, crossplane, manifest-tool, cluster-api-helm-controller, cert-manager-cmctl-fips, tigera-operator, eksctl, ocm-kubernetes-controller, envoy-gateway-fips,...

GO-2026-5475 vulnerabilities

Vulnerabilities for packages: zarf, tigera-operator, trivy, dagger, grype, tw, buildkitd, steampipe, k8sgpt, rancher-agent, ctop, kots, kube-arangodb, kubescape-operator, newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, kubevela, k3s, wolfictl, k8ssandra-client, manifest-tool, gatekeepe...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: zarf, cert-manager-cmctl, trivy, dagger, grype, tw, cilium-cli, buildkitd, nerdctl, steampipe, k8sgpt, ctop, kots, kubescape-operator, newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, flux-source-controller, kubevela, k3s, wolfictl, k8ssandra-client, opa,...

GO-2026-5338 vulnerabilities

Vulnerabilities for packages: zarf, tigera-operator, trivy, dagger, grype, tw, buildkitd, steampipe, rancher-agent, ctop, kots, kube-arangodb, kubescape-operator, newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, kubevela, k3s, wolfictl, k8ssandra-client, manifest-tool, gatekeeper,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: zarf, cert-manager-cmctl, trivy, helm-docs, cilium-cli, cerbos, k8sgpt, kots, chart-testing, pluto, flux-source-controller, k8ssandra-client, rancher-fleet, nova, helm-mapkubeapis, trivy-operator, envoy-gateway, eksctl, flux-helm-controller, helm-set-status, zot,...

GO-2026-5884 vulnerabilities

Vulnerabilities for packages: zarf, gitness, cert-manager-cmctl, tigera-operator, trivy, maru, tw, conftest, cilium-cli, falcoctl, kyverno-notation-aws, steampipe, rancher-agent, kots, kube-arangodb, argocd-image-updater, oras, k8ssandra-client, manifest-tool, rancher-fleet, gatekeeper, kyverno,...

GO-2026-5879 vulnerabilities

Vulnerabilities for packages: zarf, gitness, cert-manager-cmctl, tigera-operator, trivy, maru, tw, conftest, cilium-cli, falcoctl, kyverno-notation-aws, steampipe, rancher-agent, kots, kube-arangodb, argocd-image-updater, oras, manifest-tool, rancher-fleet, gatekeeper, kyverno, consul-k8s,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: tfsec, gitness, mc, aws-flb-cloudwatch, cert-manager-cmctl, goreleaser, hubble, kubernetes-dns-node-cache, cosign, conftest, cilium-cli, nerdctl, opensearch-k8s-operator, mattermost, kubernetes-dashboard, minio, steampipe, redka, aws-flb-kinesis, k8sgateway,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: argo-events, nri-haproxy, cloud-provider-gcp-cloud-controller-manager, swagger, envconsul, amazon-cloudwatch-agent-operator, conftest, cilium-cli, buildkitd, emissary, mockgen, kubernetes-dashboard, rancher-system-agent, k8sgateway, docker-credential-gcr,...

The vulnerability of the Linux operating system’s kernel, related to insufficient checking of the status of shared resources, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to insufficient checks on the status of resources that are shared among users. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-19884: Inclusion of Functionality from Untrusted Control Sphere

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

USTP-Secure — Updated!

USTP USTP means UDP Speedy Transmission Protocol. USTP keeps the same authenticated transport model, but the project name is now simply USTP again. By default, USTP uses AEAD for DATA. It also supports an optional negotiated cleartext + HMAC mode for DATA, where payload bytes are visible on the...

CVE-2026-13328

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...