CVE-2026-74260

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfdupnetdev: add nfdevxmitrecursion helpers and use them Update nftdup and nftfwd to use the nfdevxmitrecursion helpers. This patch also disables BH when transmitting the skb to address a possible migration to differen...

EUVD-2026-59407

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfdupnetdev: add nfdevxmitrecursion helpers and use them Update nftdup and nftfwd to use the nfdevxmitrecursion helpers. This patch also disables BH when transmitting the skb to address a possible migration to differen...

EUVD-2026-59350

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The Plus Addons for Elementor plugin before version 4.1.7 allowed attackers to bypass authentication, gain admin access, and create accounts with elevated roles, even when registration was disabled and the Login widget was inactive. id: CVE-2021-24175 info: name: The Plus Addons for Elementor Pag...

CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

EUVD-2026-58648

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-53784

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

EUVD-2026-57832

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

PT-2026-71623

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-67990

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-18678

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

EUVD-2026-57427

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

EUVD-2026-57425

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...

CVE-2026-67287

Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...

CVE-2026-68434

The CVE affects Linux kernel 8250_mid serial driver on Denverton (DNV), Ice Lake Xeon D (ICX-D) and Snowridge (SNR) platforms. Root cause: NULL function pointer dereference after changing setup/exit callbacks to PTR_IF(false, ...) without NULL checks in mid8250_probe() and mid8250_remove(), leadi...