EUVD-2026-58821

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

EUVD-2026-58817

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

EUVD-2026-58810

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...

SUSE CVE-2022-4993

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

PT-2026-73045

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll delete link fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...

PT-2026-72729

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fsl audmix: Validate written enum values fsl audmix put mix clk src and fsl audmix put out src convert the user-provided enum item with snd soc enum item to val before checking whether the item is within the enum's ite...

PT-2026-72910

In the Linux kernel, the following vulnerability has been resolved: can: kvaser usb leaf: kvaser usb leaf wait cmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD HEADER LEN can still be...

PT-2026-72731

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac hdmi: Validate written enum value hdac hdmi set pin port mux uses the written enum value to index the texts array before calling snd soc dapm put enum double, which validates that the value is within the enum...

Linux Distros Unpatched Vulnerability : CVE-2026-72114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP...

PT-2026-72141

Name of the Vulnerable Software and Affected Versions RapiSafe – Secure Multi File Upload for Contact Form 7 versions prior to 1.0.5 Description Insufficient file path validation in the handleAjaxRemoveUpload function allows unauthenticated attackers to delete arbitrary files on the server. This...

PT-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEX ROOT header validation Add a dedicated helper to perform stricter validation of $INDEX ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

PT-2026-72167

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVE FD is only applicable to outgoing sessions. RETRIEVE FD and FINISH are only valid for incoming...

Linux Distros Unpatched Vulnerability : CVE-2026-72206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform...

PT-2026-72147

Name of the Vulnerable Software and Affected Versions MaxUpload – Big File Uploads – Increase Maximum File Upload Size versions prior to 1.4.1 Description An arbitrary file upload issue exists in the handle upload function. A filename-validation mismatch occurs because extension and MIME checks a...

CVE-2026-72160: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject dinodes with non-canonical imode type Patch series "ocfs2: harden inode validators against forged metadata", v2. This series adds three structural checks to OCFS2 dinode validation so malformed on-disk fields are...

CVE-2026-72204: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

PT-2026-72535

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt connmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmark tg shift. A shift bits value of 32 or more...

PT-2026-72389

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where index entries were not validated immediately after being read from the disk. This lack of early validation required repeated checks during lookup...

PT-2026-72485

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM ANYCLASS in check tp. SO ATMQOS stores the supplied QoS after check qos succeeds, so accepting larger values leaves invalid...

CVE-2026-72297: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...