CVE-2026-82311: Insufficient Session Expiration

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

PT-2026-93370

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1 Description A use-after-free issue occurs when the software is compiled for DNS-over-QUIC DoQ support using the --with-libngtcp2 flag. In this configuration, each DoQ stream utilizes an output...

PT-2026-93454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the KIQ ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it uses a polling fence and ha...

PT-2026-93453

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the MES scheduler ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it lacks a drm...

PT-2026-93436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description On s390 systems using a machine level hypervisor, PCI devices are accessed via PCI pass-through on a per PCI function granularity. A flaw exists in the s390 PCI hotplug driver where the...

PT-2026-93294

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

PT-2026-93483

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx SCSI driver where the qla nvme xmt ls rsp function fails to properly check if the firmware has started before calling qla nvme ls reject iocb. This leads t...

PT-2026-93401

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with fab session backend=database. This occurs because the cleanup...

GHSA-9VWC-PC8P-253Q Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled .withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting th...

Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

An ember server with HTTP/2 enabled .withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS on streams opened by the peer. A single unauthenticated connection can open an unbounded number of concurrent streams, each of which allocates per-stream server state that is never released, exhausting th...

CVE-2026-81920

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-81920 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

EUVD-2026-79285

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-81920 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-81920 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...

libkcapi security, bug fix, and enhancement update

An update is available for libkcapi. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libkcapi allows user-space to access the Linux kernel crypto API. This...

PT-2026-92391

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.exclude words but did not validate the anti-CSRF token that the reset modal emitted, and...

CVE-2026-81920: Cross-Site Request Forgery (CSRF)

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...