PT-2026-76723

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description In the glances/actions.py file, the GlancesActions.run function fails to respect the --disable-config-exec flag when processing on-alert action commands. This occurs because the function invokes secu...

PT-2026-76724

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description An issue exists in the as dict secure function within glances/config.py where the sanitization process only validates option names against a regex pattern and fails to inspect the actual values. This...

PT-2026-76866

Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.1.10 Onyx versions prior to 3.2.14 Onyx versions prior to 4.0.0 Description An issue exists where the 'GET /api/mcp/servers' and 'GET /api/mcp/servers/persona/persona id' endpoints expose the OAuth Authorization header...

ALSA-2026:55439 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

UBUNTU-CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

PT-2026-73289

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder C:.git, which would be picked up by Git operation...

EUVD-2026-59903

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-59869

The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

EUVD-2026-59777

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability ...

CVE-2026-74527

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC ...

CVE-2026-68473

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

CVE-2026-18807

The ECS WordPress plugin (versions before 4.3.8) lacks capability and ownership checks on dynamic repeater AJAX handlers, allowing any contributor-level user to read, modify, or delete other users' post binding configurations and alter site-wide presets. Remediation is to upgrade to ECS 4.3.8 or ...

PT-2026-72609

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG IP MULTIPLE TABLES is enabled but no rule is added, fib lookup performs route lookup directly on two tables. Since the first lookup does not properly bail out,...

PT-2026-72185

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIG PPC E500 in mask user address mask user address incorrectly checks for CONFIG E500 instead of CONFIG PPC E500, causing mask user address isel to not be used on E500 hardware. Fix the chec...

PT-2026-73041

Name of the Vulnerable Software and Affected Versions LB-LINK X-PRO version 1.0.22-20231206 Description A security flaw exists in the /etc/config/easycwmp file that allows for the use of hard-coded credentials. This issue can be exploited remotely, although the attack is considered highly complex...

CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-73849

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73849

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73849 emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73849

In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...