Openpanel versions before 2.3.0 have an unauthenticated server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint. This flaw allows remote attackers to make arbitrary HTTP requests from the server without validation, potentially accessing internal services and cloud metadata endpoints. The vulnerability can leak internal IP addresses and expose internal network information. The issue is fixed in version 2.3.0.
AI agents using the x402 protocol to autonomously make payments can inadvertently leak payment data, including personally identifiable information (PII), by oversharing in payment metadata. This occurs because agents are not currently constrained by security controls typical in payment systems, such as spend caps, PII scrubbing, or rate limiting. The issue was demonstrated in a May 2026 arXiv paper that tested real SDKs and live endpoints, revealing multiple attack classes including replay and authorization bypass, but the primary concern is data leakage through payment metadata on public, irreversible payment rails.
Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.
This issue affects Apache Allura: through 1.20.0.
Users are recommended to upgrade to version 1.21.0, which fixes the issue.
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)
CVE-2026-80737 is a vulnerability in the Linux kernel's serial driver for amba-pl011. The issue arises because dmaengine_terminate_all() does not wait for a running DMA callback to complete, allowing the TX callback to access the TX buffer after it has been freed. Additionally, the RX poll timer reads RX buffers without holding the port lock. The vulnerability is addressed by switching to dmaengine_terminate_sync() and deleting the RX timer before freeing buffers.
A use-after-free vulnerability in the Linux kernel's ata pata_sl82c105 driver was fixed. The issue involved accessing a PCI device's revision field after the device reference was dropped, potentially leading to use-after-free. This vulnerability is addressed by reading the revision before releasing the device reference. Multiple Linux kernel versions are affected. The vulnerability has a CVSS score of 7.8, indicating high impact on confidentiality, integrity, and availability. A patch is available to remediate this issue.
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos. This incorrect value was then propagated to the driver data and used by F54 to determine the diagnostics report size. On devices with more RX than TX electrodes, this inflated the perceived TX count, leading to incorrect report size calculations and potential out-of-bounds buffer accesses. Fix the typos by correctly assigning the TX electrode counts.
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.
The npm package 'eslint-rxjs' version 1.0.1 is identified as a malicious package masquerading under a misleading name and metadata. It contains no legitimate functionality and includes a postinstall script that executes code on the installer's machine, sending an HTTP request to an attacker-controlled ngrok domain. This behavior confirms code execution and leaks the installer's IP address and installation timing, representing a reconnaissance stage of a supply-chain attack.
CVE-2026-83557 is a deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.11.0 up to but excluding 2.18.10, 2.19.0 up to 2.21.6, 2.22.0 up to 2.22.2, 3.0.0 up to 3.1.6, and 3.2.0 up to 3.2.2. The issue arises because the DefaultBaseTypeLimitingValidator does not include java.lang.Comparable in its unsafe base types list, allowing polymorphic deserialization of any class implementing Comparable when @JsonTypeInfo is used without a custom validator. This can lead to attacker-controlled object instantiation, such as creating a java.io.File with an attacker-chosen path. No direct code execution via deserialization alone has been identified. Global default typing with explicit validators is not affected. Users should upgrade to fixed versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 to remediate.
CVE-2026-82926 is a NULL pointer dereference vulnerability in Samsung Open Source mTower that allows pointer manipulation. This flaw affects versions of mTower before commit afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a. The vulnerability has a moderate severity with a CVSS score of 5.5 and impacts availability without affecting confidentiality or integrity.
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.
CVE-2026-19032 is a medium severity vulnerability in FasterXML jackson-databind that involves unsafe reflection via deserialization of java.nio.file.Path from untrusted JSON input. The vulnerability arises because the deserialization process resolves a URI scheme from attacker-controlled input and uses it to select a FileSystemProvider via Java's ServiceLoader mechanism without restricting schemes. While built-in providers do not perform network I/O or mounting, a third-party provider could potentially be triggered, leading to side effects. The issue affects multiple jackson-databind versions from 2.8.0 up to but excluding 3.2.2 in various version ranges. No direct code execution or data confidentiality impact is described, and the impact is bounded by the behavior of the selected FileSystemProvider.