CVE-2026-36471

Deserialization of Untrusted Data of the postdata parameter in cnparseurl in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables including referer via a crafted base64-encoded serialized PHP payload submitted as a POST parameter...

CVE-2026-36471

The software CuteNews v.2.1.2 is vulnerable to an insecure deserialization flaw affecting the ** b_post_data** parameter within the cn_parse_url() function. A remote attacker can exploit this by submitting a crafted base64-encoded serialized PHP payload as a POST parameter. This allows for the in...

PT-2026-96302

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3 Description Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls the applySqlVariables function from server/sources/shared/sql/sql.variables.js without enabling the...

EUVD-2026-83993

Deserialization of Untrusted Data of the postdata parameter in cnparseurl in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables including referer via a crafted base64-encoded serialized PHP payload submitted as a POST parameter...

PT-2026-103112

Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values...

PT-2026-95952

Name of the Vulnerable Software and Affected Versions code-projects Internship Management System version 1.0 Description A security flaw allows remote attackers to perform SQL injection, a technique used to manipulate database queries, by manipulating the Password variable within the...

OPENSUSE-SU-2026:21874-1 Security update for python-GitPython

This update for python-GitPython fixes the following issues: - CVE-2026-67322: environment-variable exfiltration in Repo.clonefrom URL via os.path.expandvars bsc1273357. - CVE-2026-67323: unguarded Git options passed as keyword arguments in Repo.archive and git.lsremote allow for command injectio...

CVE-2026-93133

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

DEBIAN-CVE-2026-93133

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

DEBIAN-CVE-2026-90114

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

EUVD-2026-82241

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

CVE-2026-93133 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

CVE-2026-90114 net: bridge: Reject descending VLAN tunnel ranges

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

EUVD-2026-81707

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

CVE-2026-90114 net: bridge: Reject descending VLAN tunnel ranges

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

CVE-2026-90114: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

CVE-2026-93133: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

GO-2026-6451 webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd

webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd...

AZL-101664 CVE-2026-89920 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...