Apple IOKit DriverKit Race Condition

Apple IOKit contains a race condition that may allow an app to cause unexpected system termination or write kernel memory. The supplied analysis includes a sanitizer-checked proof of concept model of the reported DriverKit RPC state-handling flaw...

PT-2026-107480

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...

Microsoft SQL Server OLE DB Code Execution

The vulnerability of the OLE DB driver of the Microsoft SQL Server database management system is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Adobe Campaign Classic < 7.4.3 build 9398 Multiple Vulnerabilities (APSB26-114)

The version of Adobe Campaign Classic installed on the remote host is prior to 7.4.3 build 9398. It is, therefore, affected by multiple vulnerabilities: - An incorrect authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of thi...

PT-2026-107676

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

PT-2026-107690

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Description An unauthenticated user with network access to the Patroni REST API on a search head cluster member can execute arbitrary operating-system...

Linux Distros Unpatched Vulnerability : CVE-2026-106250

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access...

Linux Distros Unpatched Vulnerability : CVE-2026-106296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system...

Linux Distros Unpatched Vulnerability : CVE-2026-106301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system...

PT-2026-107599

Name of the Vulnerable Software and Affected Versions Cisco NX-OS affected versions not specified Description An out-of-bounds read issue exists within the software. An out-of-bounds read occurs when the system reads data past the end or before the beginning of the intended buffer, which can lead...

PT-2026-107617

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC affected versions not specified Description Insufficient access control to file system resources within the export policies functionality allows an authenticated remote attacker with...

Linux Distros Unpatched Vulnerability : CVE-2026-106244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted networ...

Security Bulletin: Due to the use of IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Vulnerabilities found in IBM Db2 LUW that affect Foundation and IBM Tivoli Monitoring ITM pattern Types pTypes shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System v2.3.5.1. IBM Cloud Pak System provides IBM Db2 with BLU Acceleration Pattern 1.2.26.0...

Security Bulletin: Multiple Vulnerabilities in IBM® SDK, Java™ Technology affect IBM Cloud Pak System

Summary Multiple Vulnerabilities have been found in IBM® SDK, Java™ Technology that is shipped with IBM Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities as per the IBM® SDK, Java™ Technology April 2026 in IBM Cloud Pak System 2.3.5.1. Vulnerability Details...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with "security IMPORTLOCALPATHS = true", a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-104046

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...

CVE-2026-102163

Affected Arista access points with the Wireless Intrusion Prevention System (WIPS) active are vulnerable to a flaw where an unauthenticated attacker in radio frequency (RF) proximity can send a crafted frame . This action can crash the sensor service , leading to the disablement of WIPS monitorin...