PT-2026-77180

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

PT-2026-77335

The Zephyr kernel validates the k thread join and k thread abort system calls declared syscall in include/zephyr/kernel.h through thread obj validate in kernel/thread.c. Its default switch branch is the access-denied path, taken when k object validate returns -EPERM the calling user thread was...

PT-2026-77162

CodeWhale versions before 0.8.64 fail to properly validate the allow shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-2067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2067 advisory. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit...

PT-2026-77170

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify profile fields only performs the specialized validation when is...

Linux Distros Unpatched Vulnerability : CVE-2026-72351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is...

Amazon Linux 2 : perl-Date-Manip, --advisory ALAS2-2026-3856 (ALAS-2026-3856)

The version of perl-Date-Manip installed on the remote host is prior to 6.41-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3856 advisory. Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeri...

PT-2026-77275

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs...

PT-2026-77210

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

GitLab 18.2 < 18.11.11 / 19.0 < 19.0.8 / 19.1 < 19.1.6 / 19.2 < 19.2.4 (CVE-2026-19650)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have...

Linux Distros Unpatched Vulnerability : CVE-2026-72417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: Validate iph-ihl in nfflowip4tunnelproto Add sanity check for iph-ihl field in nfflowip4tunnelproto before using it to compute the header...

Linux Distros Unpatched Vulnerability : CVE-2026-72078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint withou...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101998 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIEECHO processing When a listening SCTP serve...

CVE-2026-75081

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

CVE-2026-9816

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...

CVE-2026-65349

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory...

CVE-2026-64781

The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...

CVE-2026-9816

Mattermost 11.7.x (≤11.7.6), 10.11.x (≤10.11.21), and 11.8.x (≤11.8.3) lack server-side validation of BoardMember.Scheme* fields on insert and archive-import paths, allowing board editors or non-guest team members to grant Board Admin to arbitrary users via POST /api/v2/boards/{boardID}/members a...

CVE-2026-9816

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...