Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002318)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002318 advisory. Multiple buffer overflows in drivers/staging/wlags49h2/wlpriv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001926)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001926 advisory. The doumount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAPSYSADMIN capability for doremountsb calls that change the root...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002000)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002000 advisory. The scmcheckcreds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check in an incorrect namespace, which allows local users to gain...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003421)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003421 advisory. The netlinkdelivertapskb function in net/netlink/afnetlink.c in the Linux kernel through 4.14.4, when CONFIGNLMON is enabled, does not restrict observations of Netli...

The vulnerability of the access controller service allows attackers to exploit the Capability Access Management Service (camsvc) of Windows operating systems, thereby enabling them to increase their privileges.

The vulnerability of the access controller service related to the Capability Access Management Service camsvc of Windows operating systems is associated with synchronization errors when using a shared resource “Race Conditions”. Exploiting this vulnerability can allow an attacker to increase thei...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002766)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002766 advisory. A security flaw was discovered in the nl80211setrekeydata function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003066)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003066 advisory. A security flaw was discovered in the nl80211setrekeydata function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002055 advisory. The doumount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAPSYSADMIN capability for doremountsb calls that change the root...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001907)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001907 advisory. net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service NULL pointer dereference and system crash by...

CVE-2026-20851

Out-of-bounds read in Capability Access Management Service camsvc allows an unauthorized attacker to disclose information locally...

CVE-2026-20835

Out-of-bounds read in Capability Access Management Service camsvc allows an authorized attacker to disclose information locally...

CVE-2026-21221

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

CVE-2026-20830

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

CVE-2026-20815

Concurrent execution using shared resource with improper synchronization 'race condition' in Capability Access Management Service camsvc allows an authorized attacker to elevate privileges locally...

CVE-2025-15512

The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checksuccessresponse function in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to set any WooCommerce order ...

EUVD-2026-2528

The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checksuccessresponse function in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to set any WooCommerce order ...

CVE-2025-10915

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check...

CVE-2025-14854

The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrmgetemailrecipients and wpcrmsystemajaxtaskchangestatus AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with...

CVE-2025-14482

The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with...

CVE-2025-14482 Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with...