EUVD-2026-80094

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-93297

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

PT-2026-93401

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with fab session backend=database. This occurs because the cleanup...

CVE-2026-84907: Missing Authorization

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

PT-2026-93461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A lock leak occurs during a GPU reset. The dm suspend function acquires the dc lock and expects dm resume to release it. However, if the functions amdgpu dm commit zero streams or dm dmu...

CVE-2026-89812: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-85530: Improper Privilege Management

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

PT-2026-93294

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

PT-2026-93667

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb: typec: qcom-pmic component where the pdphy stop function disables IRQs but leaves reset work pending. If the IRQ handler schedules this work immediately befor...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38422)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in the TOTOLINK T6. This vulnerability stems from improper access control in the LoadDefSettings function. Attackers can exploit this vulnerability by sending a specially crafted POST...

PT-2026-93483

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx SCSI driver where the qla nvme xmt ls rsp function fails to properly check if the firmware has started before calling qla nvme ls reject iocb. This leads t...

CVE-2026-89850: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00fwstateshow initializes rval to QLAFUNCTIONFAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued...

CVE-2026-89820: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...

PT-2026-93370

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1 Description A use-after-free issue occurs when the software is compiled for DNS-over-QUIC DoQ support using the --with-libngtcp2 flag. In this configuration, each DoQ stream utilizes an output...

CVE-2026-89795: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always accessed through a form of PCI pass-through which fundamentally operates on a per PCI...

PT-2026-93454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the KIQ ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it uses a polling fence and ha...

PT-2026-93453

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the MES scheduler ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it lacks a drm...

PT-2026-93436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description On s390 systems using a machine level hypervisor, PCI devices are accessed via PCI pass-through on a per PCI function granularity. A flaw exists in the s390 PCI hotplug driver where the...

CVE-2026-82311: Insufficient Session Expiration

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

Linux Distros Unpatched Vulnerability : CVE-2026-89812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion...