PT-2026-115662

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's atwinc15x0 sta set current ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE ATWINC15X0...

PT-2026-116050

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to...

EUVD-2026-102904

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

PT-2026-116069

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

EUVD-2025-211112

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function utils/error.c. Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac to divide by zero, terminating the process with SIGFPE...

PT-2026-115884

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

PT-2026-116126

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf parse lfrac function utils/error.c. Processing a crafted MP4 file containing a zero-denominator fraction string causes gf parse lfrac to divide by zero, terminating the process with SIGFPE...

CVE-2026-104715

A non-privileged user can control a CIFS credentials file consumed by a privileged mount.cifs invocation, and the value from the credentials file is copied into the mount option string without validation. As a result, attacker-controlled mount options can be injected into the privileged mount...

CVE-2026-111271

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

PT-2026-116102

yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details,...

Unbreakable Enterprise kernel security update

5.15.0-325.221.6.4 - ipv4: free inetopt and ireqopt after an RCU grace period Eric Dumazet Orabug: 40167661 CVE-2026-98432 - ipv4: validate checksumstart before completing checksum Michael S. Tsirkin Orabug: 40167656 CVE-2026-99999 - netfilter: nfnetlinkqueue: unbreak SCTP traffic Antonio Ojea...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-110875

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory...

PT-2026-116093

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDept...

PT-2026-115627

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

PT-2026-116104

Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contac...

PT-2026-116124

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an...

PT-2026-115652

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

CVE-2026-111165

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...