CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994 Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-49994

Bluehood , a local Bluetooth activity monitor, is vulnerable to an authentication bypass in versions prior to 0.7.1 . When auth_enabled is active, only HTML page handlers enforce session validation; however, the */api/ handlers (including settings, devices, groups, and per-device endpoints like /...

Uncontrolled Resource Consumption

Apache Tomcat is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to an allocation leak in HTTP/2 backlog tracking when streams are reset, which allows a remote attacker to repeatedly reset streams and consume server resources, potentially causing denial of service...

PT-2026-102288

Name of the Vulnerable Software and Affected Versions Bluehood versions prior to 0.7.1 Description When auth enabled is active, session validation is only enforced on HTML page handlers. The /api/ endpoints, including /api/device/mac/notes, do not perform authentication checks. A network attacker...

CVE-2026-49994: Missing Authentication for Critical Function

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-96283

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped...

PT-2026-99723

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A flaw exists in the flatpak-system-helper where calling the org.freedesktop.Flatpak.SystemHelper.CancelPull endpoint on a pull belonging to another user fails to actually cancel the operatio...

sBOMBPath

sBOMBPath Finds whether user input in your Python code can re...

CVE-2026-56735

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

EUVD-2026-87215

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-97417

A flaw was found in the Linux kernel's netfilter connection tracking subsystem. The TCP option processing mechanism improperly assumes memory alignment when reading packet headers. A remote attacker could exploit this vulnerability by sending crafted TCP packets with misaligned SACK options throu...

CVE-2026-19804

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...

CVE-2026-19804 s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...

CVE-2026-19804

The s2Member plugin for WordPress (versions up to and including 260814 ) is vulnerable to Remote Code Execution (RCE) . The root cause is insufficient sanitization of the first_name parameter using esc_refs(), which fails to strip PHP tags before they are substituted into an eval'd Signup Trackin...