EUVD-2026-81282

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

PT-2026-94337

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description When operating in prefill/decode disaggregation mode, the prefill bootstrap service exposes an unauthenticated PUT '/route' endpoint. This allows an attacker to poison the KV transfer routing table b...

CVE-2026-93159: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

CVE-2026-92972: Missing Authentication for Critical Function

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

CVE-2026-25278: Time-of-check Time-of-use (TOCTOU) Race Condition

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying...

PT-2026-94917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ffs dmabuf transfer function within the USB gadget f fs module. In error paths related to endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM, the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: coredns (UTSA-2026-109796)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109796 advisory. CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. F...

PT-2026-94145

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs during the processing of I2C transfer requests. This issue is caused by a race condition, which is a situation where the timing or order...

CVE-2026-61642

Request Smuggling in HTTP Transfer-Encoding...

UBUNTU-CVE-2026-61642

Request Smuggling in HTTP Transfer-Encoding...

PT-2026-94865

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tc358767 bridge driver where the tc aux transfer function fails to properly clamp the byte count reported by the controller in AUX BYTES back to the original reque...

CVE-2026-92582

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

CVE-2026-92582

AVideo (WWBN/AVideo) through 29.0 is vulnerable to cross-site request forgery (CSRF) in objects/videoAddNew.json.php. The file disables AVideo's automatic CSRF guard and untrusted-request check solely because user and pass parameters are present in the request; their values are never validated an...

CVE-2026-92582 AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

CVE-2026-92582 AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

CVE-2026-92582 AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

CVE-2026-20194

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

EUVD-2026-81100

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20194 Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC, engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release...

CVE-2026-20194

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are affected by a vulnerability classified as CWE-669 (Incorrect Resource Transfer Between Spheres) , discovered during an internal security review. The flaw permits high-privilege network attackers to achieve...