CVE-2026-73804: Incorrect Privilege Assignment

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-55679: Improper Neutralization of Special Elements used in an OS Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-110853: Authorization Bypass Through User-Controlled Key

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to...

CVE-2026-110764: Authorization Bypass Through User-Controlled Key

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since...

CVE-2026-98388: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: exec: docloseonexec before taking execupdatelock docloseonexec currently happens while holding the execupdatelock, which is used in a lot of places that access process state to synchronize access checks. I recently added another...

CVE-2026-75085: Out-of-bounds Read

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

CVE-2026-110270: Inefficient Algorithmic Complexity

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

CVE-2026-100231: Out-of-bounds Write

A flaw was found in the GStreamer multimedia framework's ASF muxer plugin asfmux. When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane such as emoji to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE...

CVE-2026-102029: NULL Pointer Dereference

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated configured MSDP peer or adjacent PIM sender to cause a denial of service via an MSDP or PIM policy that uses AS-path expansion...

CVE-2026-102184: Improper Validation of Specified Quantity in Input

An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos Evolved platforms allows a configured EVPN signaling peer to cause an rpd crash via a malformed SRv6 structure carried in an EVPN route update. The result ...

CVE-2026-110761: Deserialization of Untrusted Data

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tstsequence sequence attribute that is passed to...

CVE-2026-110614: Improper Neutralization of Special Elements used in an SQL Command

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful...

CVE-2026-102176: Buffer Copy without Checking Size of Input

A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service an...

CVE-2026-107153: Use of Weak Credentials

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...

CVE-2026-73135: Exposure of Sensitive Information to an Unauthorized Actor

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The...

CVE-2026-97205: Use After Free

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing “include virtual” commands may trigger a Use-After-Free UAF in the NGINX worker process...

CVE-2026-89069: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer Ad Hoc module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89068: Missing Critical Step in Authentication

Missing critical step in authentication vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89067: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-77371: Improper Access Control

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-76655: Stack-based Buffer Overflow

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution...

CVE-2026-76083: Server-Side Request Forgery (SSRF)

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

CVE-2026-97629: Use of Uninitialized Resource

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

CVE-2026-96615: Authentication Bypass by Spoofing

Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRP...

CVE-2026-98427: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrtcount after the previous drop, using the configured interval codelparams.interval. For very small intervals...

CVE-2026-98426: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiexpcierequestirq registers each MSI-X vector with a per-index devid &card-msixctxi. On a requestirq failure the cleanup loop "for j = 0; j msixctxi as the...

CVE-2026-98420: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

CVE-2026-98418: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its...

CVE-2026-98416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

CVE-2026-98414: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...

CVE-2026-98412: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrsequnitnew If memory allocation fails in pwrsequnitsetupdeps, pwrsequnitput is called to release the partially initialized unit. However, we've never initialized unit-list and...

CVE-2026-98408: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-98403: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...

CVE-2026-98400: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

CVE-2026-98399: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some...

CVE-2026-98398: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale classcache entries for zapped classes syzbot reported a lockdep splat hitting DEBUGLOCKSWARNON1 in hlockclass due to an invalid classidx: WARNING: kernel/locking/lockdep.c:238 at...

CVE-2026-98397: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98396: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

CVE-2026-98395: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irqsoftmask corruption on replayed interrupt exit When replaysoftinterrupts replays a pending interrupt e.g. PACAIRQDEC - timerinterrupt, it calls the handler directly with a synthetic ptregs. The...

CVE-2026-98393: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER i...

CVE-2026-94348: Improper Neutralization of Special Elements used in an SQL Command

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-97315: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...

CVE-2026-88998: Insufficient Verification of Data Authenticity

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

CVE-2026-88842: Out-of-bounds Read

A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...

CVE-2026-96904: Exposure of Sensitive Information to an Unauthorized Actor

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

CVE-2026-96900: Authorization Bypass Through User-Controlled Key

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that...

CVE-2026-94360: Missing Authorization

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed...

CVE-2026-94261: Authorization Bypass Through User-Controlled Key

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitra...

CVE-2026-92426: Incorrect Authorization

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

CVE-2026-92409: Improper Neutralization of Input During Web Page Generation

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...