PT-2026-73024

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btree writepages holds fs info-zoned meta io lock across the whole writeback loop,...

PT-2026-72960

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp recv ctrl frame and hidp recv intr frame read skb-data0 before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty...

CVE-2026-72812

SiYuan has a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint for versions before v3.7.4. The issue allows anonymous readers to trigger persistent server-side writes by supplying an attacker-controlled block ID, which can flush transaction queues, scan all references g...

CVE-2026-19016

A flaw was found in Consul. An authenticated caller with network access to the Consul server RPC port could bypass authorization checks. This vulnerability occurs because the system did not enforce the session:write Access Control List ACL permission for session deletion operations submitted...

DRUPAL-CONTRIB-2026-095

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...

PT-2026-76589

Name of the Vulnerable Software and Affected Versions Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the...

PT-2026-76559

Name of the Vulnerable Software and Affected Versions Nimiq versions prior to 1.5.1 Description The validity store uses a strict lower-bound comparison that expires stored transactions too early relative to the Transaction::is valid at function. This occurs because the store treats a transaction...

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...

CVE-2026-18709

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

EUVD-2026-56883

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709 Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709

CVE-2026-18709 concerns MongoDB Server: an authenticated user with direct network access to a shard can improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination. The underlying root cause is described as inadequate authorization around the pr...

PT-2026-70862

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-72731

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731

Discourse vulnerability CVE-2026-72731 affects 2026.1.0-latest through 2026.8.0-latest.1, including the Data Explorer query path and plugin data_explorer code, where parameterized Data Explorer queries could be crafted to escape the intended query via non-recursive and recursive parameter interpo...

CVE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

Linux Distros Unpatched Vulnerability : CVE-2026-19016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted...