PT-2026-97790

Name of the Vulnerable Software and Affected Versions Halo versions 2.25.4 and 2.26.1 Description A remote flaw exists in the SpEL Handler component within the ReplyNotificationSubscriptionHelper.java file. This issue involves improper neutralization in an unknown function, which could allow a...

PT-2026-97700

Name of the Vulnerable Software and Affected Versions ShopXO versions prior to 2.2.8 Description A path traversal issue exists in the Ueditor Upload Interface component within the config/ueditor.php file. A remote attacker can exploit this by manipulating the path type argument, allowing them to...

CVE-2026-97368: Authorization Bypass Through User-Controlled Key

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

PT-2026-98027

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the virtio-fs component. The virtio fs setup vqs function allocates fs-vqs and fs-mq map before calling virtio find vqs. If virtio find vqs fails, the error...

PT-2026-98114

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate doorbell function fails to perform bounds checking on the doorbell ID. This occurs when the doorbell ID is set to a specifi...

PT-2026-98048

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference can occur in the ASOC mediatek mt8365-afe-pcm component. The function mt8365 afe suspend uses devm kcalloc to allocate a register backup buffer but fails to...

PT-2026-98064

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xhci component where new commands could be queued on the command ring even when the xHC is marked as inaccessible. This state is managed by the HCD FLAG HW...

PT-2026-98127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt component where the tb-root switch is not properly set to NULL when a domain is stopped. This failure to clear the root switch prevents the tb xdp hand...

CVE-2026-7169: Undefined Security Weakness

a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The ‘Evope.Service.exe’ component, which runs wi...

CVE-2026-93800

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

CVE-2026-93800: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

PT-2026-97782

Name of the Vulnerable Software and Affected Versions Evope Collector versions prior to 1.1.7.13 Description An unchecked search path element allows a local attacker without privileges to perform local privilege escalation. By placing a malicious wtsapi32.dll file in the C:ProgramDataEvope...

The vulnerability of the OpenTofu infrastructure management tool is related to the presence of a vulnerability in the borrowed component, which allows a attacker to trigger a service failure.

The vulnerability of the OpenTofu infrastructure management tool is related to the presence of vulnerabilities in the borrowed components. Exploiting these vulnerabilities can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the LibreNMS network monitoring system, related to deficiencies in the blocking procedures, allows attackers to perform cross-site scripting attacks.

The vulnerability of the LibreNMS network monitoring system is related to deficiencies in the blocking procedures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the strcpy() function in the udhcpcd component of D-Link DIR-822 A1 wireless routers allows a hacker to execute arbitrary code.

The vulnerability of the strcpy function in the udhcpcd component of D-Link DIR-822 A1 wireless router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the tunnel_set_params() function in the rp-l2tp component of D-Link’s DIR-825 router software allows a hacker to execute arbitrary code.

The vulnerability of the tunnelsetparams function in the rp-l2tp component of D-Link’s DIR-825 router software lies in the fact that the operation of writing data beyond the buffer in memory occurs when processing the peerhostname parameter. Exploiting this vulnerability allows a remote attacker ...

CVE-2026-96773: URL Redirection to Untrusted Site

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-82077: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

PT-2026-98260

Name of the Vulnerable Software and Affected Versions YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09 Description Improper authorization exists in the Demo-order Payment Callback Handler component. A remote attacker can manipulate the ID argument within the updateDemoOrderPaid functi...

PT-2026-97642

Name of the Vulnerable Software and Affected Versions kvcache-ai mooncake versions 0.3.12 through 0.3.14-rc1 Description A weakness in the Regular Expression Handler component allows a remote attacker to perform a manipulation that leads to the allocation of resources. This issue specifically...