PT-2026-83320

Name of the Vulnerable Software and Affected Versions IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 Description The system fails to properly validate TLS certificates. This flaw allows an attacker to perform man-in-the-middle techniques to intercept and obtain sensitive...

The vulnerability in the io_uring/kbuf.c component of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability in the iouring/kbuf.c component of the Linux operating system’s kernel is related to insufficient checking of the status of the shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the Engine component in web browsers Firefox and Firefox ESR, as well as the Thunderbird email client, allows a perpetrator to gain access to confidential data.

The vulnerability of the Engine component in web browsers such as Firefox and Firefox ESR, as well as in the Thunderbird email client, is related to insufficient input validation. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

PT-2026-83135

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists where the source-address critical option in the Permissions returned by certain authentication callbacks is not validated against the client's remo...

PT-2026-82876

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.0 Description An issue exists where the plugin fails to validate role selection when it cannot resolve the set of roles permitted by a profile form. Instead of checking against the form's...

CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

Linux Distros Unpatched Vulnerability : CVE-2026-80717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its paramete...

The vulnerability of the vcpu_block() function in the arch/x86/kvm/x86.c module of the virtualization subsystem on the x86 architecture of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the vcpublock function in the arch/x86/kvm/x86.c module of the virtualization subsystem on the x86 architecture of the Linux operating system is related to incorrect checks for consistency in input data. Exploiting this vulnerability could allow an attacker to cause a service...

Linux Distros Unpatched Vulnerability : CVE-2026-80649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armscmi: Fix OOB in scmipowernameget scmipowernameget does not validate the domain number passed by the external caller, which may lead to an...

Linux Distros Unpatched Vulnerability : CVE-2026-81523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted witho...

CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...

CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

CVE-2026-54085 Wazuh: Missing input validation in multiple active response scripts allows argument injection

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

CVE-2026-54085

Wazuh (open-source XDR/SIEM platform), versions 4.2.0 through 4.14.6 , contains missing input validation in multiple active response scripts that pass attacker-influenced alert fields to privileged system commands running as root. Five scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c ) omit th...

CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

CVE-2026-76945

CVE-2026-76945 affects the Ebyte NE2-D11 device. The root cause is client-managed authentication tokens without sufficient server-side validation , allowing an attacker to replay or manipulate tokens to gain unauthorized access to administrative functionality . The primary impact is confidentiali...

CVE-2026-54330 Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-18717 Improper Certificate Validation in ASE 2000

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

CVE-2026-18717

ASE2000 versions 2.35 through 2.37 (by ASE Systems) contain an improper certificate validation vulnerability in the TLS implementation. An attacker with network access may impersonate a trusted peer, complete the TLS handshake, and read or modify protected communications. The CISA ICS advisory ra...

CVE-2026-81528

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...