CVE-2026-16019

FAYDAM Datalogger (by Faydam Innovation Inc.) is affected by a SQL injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions 2.7.1 through before 2.8.0 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector requirin...

PT-2026-78434

Name of the Vulnerable Software and Affected Versions Dell PowerPath versions 7.2 through 8.0 SP1 Description Improper Privilege Management allows a low privileged attacker with local access to potentially elevate their privileges. Recommendations At the moment, there is no information about a...

PT-2026-78714

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.27.2 Description An accounting defect exists in the join filter within src/filters/array.ts and the array to sentence string filter within src/filters/string.ts. The join filter calculates complexity based on...

Linux Distros Unpatched Vulnerability : CVE-2026-65976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to...

PT-2026-78417

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description A broken object level authorization BOLA flaw exists in the right-to-be-forgotten RTBF tombstone mechanism. The issue tombstone function defaulted the tenant to "default" instead of the...

PT-2026-78859

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A crash in the Bluetooth HFP Profile protocol dissector allows for a denial of service. This is caused by an out-of-bounds read, which occurs when the...

Linux Distros Unpatched Vulnerability : CVE-2026-75625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying on...

EUVD-2026-62192

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...

CVE-2026-62988

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

CVE-2026-75625

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

CVE-2026-75625

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

UBUNTU-CVE-2026-75625

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

CVE-2026-50167 Kurrier: Authenticated cross-user authorization bypass in Kurrier API

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

EUVD-2026-61139

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

CVE-2026-45125

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

CVE-2026-45125

MyBB prior to 1.8.40 is vulnerable to mail header injection via the Email User controller. The fromname HTTP parameter (or stored username) is used unsanitized in Return-Path and Reply-To headers when mail_handler is PHP mail, enabling arbitrary header injection via CRLF sequences. CVSS 5.3 (Medi...

EUVD-2026-60612

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-34884

Apache SkyWalking MCP version 0.1.0 is affected by two vulnerabilities: an SSRF via the set_skywalking_url tool and a GraphQL expression injection in the MCP Server. Both are exploitable over the network with no privileges and no user interaction required, carrying a CVSS 3.1 score of 9.8 (Critic...

PT-2026-77179

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when t...

PT-2026-77274

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...