com.powsybl:powsybl-action-dsl (6.0.0-rc1), com.powsybl:powsybl-action-dsl-spi (6.0.0-rc1) +42 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.0.0-rc1)

com.powsybl:powsybl-computation-local MAVEN version 6.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-dsl 6.0.0-rc1 - com.powsybl:powsybl-action-dsl-spi...

com.powsybl:powsybl-action-api (6.7.0-rc1), com.powsybl:powsybl-action-ial-dsl (6.7.0-rc1) +47 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.7.0-rc1)

com.powsybl:powsybl-computation-local MAVEN version 6.7.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-api 6.7.0-rc1 - com.powsybl:powsybl-action-ial-dsl...

CVE-2026-55066

Vikunja (open-source self-hosted task management) has a cross-tenant IDOR in the kanban move-task endpoint. The task_id field is attacker-controlled via the request body, yet TaskBucket.CanUpdate only authorizes the project/view/bucket from the URL — never the task itself. Because Task.ReadOne pe...

CVE-2026-55066: Authorization Bypass Through User-Controlled Key

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

SUSE CVE-2026-72494

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barriers around requestdone. An earlier patch by Gui-Dong Han attempted to...

SUSE CVE-2026-74310

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb referenc...

SUSE CVE-2026-74677

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...

EUVD-2026-66284

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...

CVE-2026-77694 Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...

WordPress Eventin plugin < 4.1.19 - Unauthenticated Order Completion Without Payment vulnerability

Unauthenticated Order Completion Without Payment vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event SOlution versions 4.1.19...

CVE-2026-77694

The Eventin (or WP Event Solution ) WordPress plugin before version 4.1.19 contains a vulnerability where it fails to properly restrict the actions a guest checkout token can authorize on an order. This flaw allows unauthenticated users to mark their own unpaid orders as completed, resulting in t...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098724)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098724 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req-iv after cryptoaeadencrypt As soon as cryptoaeadencrypt is called,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104594)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104594 advisory. In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098817)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098817 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: split transactions in dio completion to avoid credit exhaustion During ocfs2 dio operation...

Vim < 9.2.0845 Command Injection (CVE-2026-73073)

The version of Vim installed on the remote host is prior to 9.2.0845. It is, therefore, affected by a command injection vulnerability: - StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tag...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host – Fixed the dereference issue in the DDMA completion flow. The dereference issue in the DDMA completion flow has been addressed...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replaced waitqueue and flag with completion. The driver previously used a waitqueue along with an explicit requestdone flag, but there were no proper barriers around the requestdone operation. A previous patch by...

MiracleLinux 9 : vim-8.2.2637-26.el9_8.13.ML.1 (AXSA:2026-1631:22)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1631:22 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious...

CVE-2026-74709 xsk: clear metadata pointer when no timestamp is requested

In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested whe...

WordPress Conekta Payment Gateway plugin < 6.2.2 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Pedro Pinho in WordPress Plugin Conekta Payment Gateway versions 6.2.2...