212496 matches found
PT-2026-90241
In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s num entries stores the number of entries in that array, not the highest valid index. The...
PT-2026-90082
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3c master unregister i3c devs clears i3cdev-dev-desc before calling device unregister. During device unregister, device del emits a KOBJ REMOVE uevent and unbinds the...
PT-2026-90264
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache cleaner before destroying a cache detail sunrpc destroy cache detail only cancels the global cache cleaner delayed work when cache list is empty. During per-netns teardown cache list is never empty...
PT-2026-90108
In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...
PT-2026-90155
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sst inst To be consistent with other places, add a NULL check for failed socket loading by checking isst common.sst inst...
PT-2026-90407
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4 release compoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value...
PT-2026-90359
In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit del rule is used for both netlink deletion templates and internal fsnotify autoremove. The former passes a parsed template which owns a temporary tree referenc...
PT-2026-90515
A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...
PT-2026-90468
Content removed...
PT-2026-90257
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss unwrap resp priv length checks gss unwrap resp priv validates the RPCSEC GSS opaque length with offset = u8 p - u8 head-iov base; if offset + opaque len rcv buf-len goto unwrap failed; maj stat = gss unwrapctx-...
PT-2026-89827
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux accept performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the...
PT-2026-90545
Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...
PT-2026-90387
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3 proc setacl calls set posix acl unconditionally for both ACL TYPE ACCESS and ACL TYPE DEFAULT, passing argp-acl access and argp-acl default verbatim. The NFSv3 ACL decoder only populates...
PT-2026-90366
In the Linux kernel, the following vulnerability has been resolved: ceph: bound num export targets array for mds info v2/v3 ceph mdsmap decode in fs/ceph/mdsmap.c reads num export targets from each per-mds info record and advances the decode cursor by num export targets sizeofu32 without first...
PT-2026-90374
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40 clean admin revoked takes a stateid reference under clp-cl lock, drops nn-client lock, and calls nfsd4 drop revoked stid, which dereferences the...
PT-2026-90049
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...
PT-2026-89680
Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...
PT-2026-89369
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
PT-2026-89406
π¨ CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or creat...
PT-2026-89522
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...
PT-2026-89691
Summary POST /api/acp/agents registers a custom ACP agent. The endpoint accepts user-controlled binary and versionCommand values. After saving the custom agent, the same request calls refreshAgentCache, which triggers agent version detection. The version probe eventually runs: ts...
PT-2026-89381
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...
PT-2026-89457
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...
PT-2026-89265
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wp ajax ba cheetah disable AJAX handler is registered without any capability or nonce...
PT-2026-89622
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...
PT-2026-89325
GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...
PT-2026-89399
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...
PT-2026-89639
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
PT-2026-89467
Dell ThinOS 10, versions prior to 2605 10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution...
PT-2026-89466
Dell ThinOS 10, versions prior to 2605 10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...
PT-2026-89630
IBM Langflow OSS 1.0.0 through 1.11.5...
PT-2026-89644
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication...
PT-2026-89490
An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri url launcher.dart, OpenFilex.open, localPathRegex common patterns.dart components...
PT-2026-89438
Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...
PT-2026-89607
An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in ego replan fsm.cpp...
PT-2026-89437
Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...
PT-2026-89655
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...
PT-2026-89338
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user meta save function which only sanitizes array values, not scalar...
PT-2026-89321
GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker...
PT-2026-89403
OpenPanel is an analytics platform. In all versions no patched release available at time of publication, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts,...
PT-2026-89611
π¨ CVE-2026-78569 IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner. π@cveNotify...
PT-2026-89424
The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendor standalone/hl78xx/ embeds a generic struct gnss nmea0183 match data match data inside struct hl78xx gnss data. The generic NMEA0183 match helper drivers/gnss/gnss nmea0183 match.c requires that context ...
PT-2026-89685
Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...
PT-2026-89384
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...
PT-2026-89318
π¨ HIGH: CVE-2026-88277 CVSS 8.8 - GeoVision GV-LPC2211 V1.13 vulnerable to authenticated command injection via ONVIF. Attackers can execute arbitrary commands as root. Patch immediately. CVE Vulnerability PatchNow https://t.co/0HQ3GCjvsH...
PT-2026-89692
Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...
PT-2026-89650
Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...
PT-2026-89606
An issue in Robotics-STAR-Lab SYSU STAR Group RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the exploration state machine...
PT-2026-89258
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
PT-2026-89619
π¨ CVE-2026-79742 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist. π@cveNotify...