CVE-2026-19760: Improper Neutralization of Input During Web Page Generation

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098790)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098790 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-by...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099011)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099011 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidateremove function has incomplete logic f...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098725)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098725 advisory. In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTORAW MUST drop incoming ICMP Yizhou Zhao reported that simply havi...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: unbound (UTSA-2026-104836)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104836 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098899)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098899 advisory. In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fusetrymovefolio unlocks the request on...

TencentOS Server 3: unbound (TSSA-2026:0887)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0887 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

PT-2026-82374

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Two distinct issues were identified. First, a module designed to restrict access to the /user/login endpoint via a secret key fails to invalidate relevant caches...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104806)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104806 advisory. In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104751)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104751 advisory. Type confusion in PostgreSQL module refint allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098743)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098743 advisory. In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSENOTIFYRETRIEVE to uptodate folios FUSENOTIFYRETRIEVE must be limited to uptodate...

Vinyl Cache: Multiple Vulnerabilities

Background Vinyl Cache is a web application accelerator. Vinyl Cache was previously named Varnish. Description Multiple vulnerabilities have been discovered in Vinyl Cache. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...

VulnCheck KEV: CVE-2026-46331

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcfpeditact computes the COW range for skbensurewritable once before the key loop using tcfpoffmaxhint, but the hint does not account for the runtime header offset...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104815 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104805)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104805 advisory. In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS...

Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)

"The remote Ubuntu 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8663-1 advisory. It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could...

CVE-2026-41707

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707

Spring Security 's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack . The internal cache that stores JWT ID claims has a strict size limit, which an attacker can exploit by flooding the server with dummy requests to evict legitimate entries, then replaying intercepted valid...