CVE-2026-86739: Unchecked Return Value

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-86749: Unchecked Return Value

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

PT-2026-89008

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description In the AccountAcceptanceController::store function, the software fails to verify the return value of Storage::put when saving signature PNGs and generated acceptance PDFs. On filesystem drivers that...

The vulnerability of the ogs_sbi_timeParse() function, a tool for creating and managing NR/LTE Open5GS mobile networks, allows a attacker to cause a service failure.

The vulnerability of the ogssbitimeParse function, a component of the NR/LTE Open5GS network creation and management tool, lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

CVE-2026-86482

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

EUVD-2026-72498

In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation...

CVE-2026-86482

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

CVE-2026-86482

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation...

CVE-2026-86482

JetBrains YouTrack prior to version 2026.2.18634 is affected by a privilege escalation vulnerability caused by unchecked group membership changes , allowing a low-privileged user to escalate their permissions. The flaw is exploitable over the network with low attack complexity and no user interac...

PT-2026-86854

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18634 Description Insufficient validation of role assignments allows for privilege escalation, where a user can gain higher access levels than intended. Recommendations Update to version 2026.2.18634...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053247)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053247 advisory. In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in registerdevice In registerdevice, the return value of idasimpleget i...

CVE-2026-85661 excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85661 excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85649

Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...

The vulnerability of the iptfs_consume_frags() function in the net/xfrm/xfrm_iptfs.c module, a component of the Linux kernel’s networking functions, allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the iptfsconsumefrags function in the net/xfrm/xfrmiptfs.c module, which is part of the Linux kernel’s networking functions, relates to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the batadv_dat_forward_data() function in the net/batman-adv/distributed-arp-table.c module, which is part of the networking functions of the Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the batadvdatforwarddata function in the net/batman-adv/distributed-arp-table.c module, which is part of the networking functions in the Linux kernel, stems from the lack of checking the return value. Exploiting this vulnerability could allow a remote attacker to cause a...

CVE-2026-53720 pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i32 implementation does not check the nbblocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i32 will write past the end of the buffer and possib...

CVE-2026-84963 Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticat...

CVE-2026-84963 Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticat...

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticat...