WordPress Eventin plugin < 4.1.19 - Unauthenticated Order Completion Without Payment vulnerability

Unauthenticated Order Completion Without Payment vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event SOlution versions 4.1.19...

EUVD-2026-66284

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...

CVE-2026-77694 Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098724)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098724 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req-iv after cryptoaeadencrypt As soon as cryptoaeadencrypt is called,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098817)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098817 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: split transactions in dio completion to avoid credit exhaustion During ocfs2 dio operation...

Vim < 9.2.0845 Command Injection (CVE-2026-73073)

The version of Vim installed on the remote host is prior to 9.2.0845. It is, therefore, affected by a command injection vulnerability: - StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tag...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Prevents handling of any completions after the destruction of a QP Queue Pair. The hardware may generate completions indicating that the QP has been destroyed. The driver should not schedule any completion handlers f...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: kdb: Buffer overflow issue during tab-complete has been fixed. Currently, when a user attempts symbol completion using the Tab key, kdb uses strncpy to insert the completed symbol into the command buffer. Unfortunately, it passes...

Astra Linux – Vulnerability in emacs

In elisp-mode.el of GNU Emacs prior to version 30.1, a user who chooses to invoke elisp-completion-at-point for code completion on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion, allowing attackers to execute arbitrary code. This unsafe expansion also occurs if a user...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nfs: fixed UAF in direct writes In production, we have been encountering the following warnings consistently: ------------ cut here ------------ refcountt: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host – Fixed the dereference issue in the DDMA completion flow. The dereference issue in the DDMA completion flow has been addressed...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Perform lockless command completion in the abort path When adding or removing controllers, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dmafree attrs+0x33/0x50 CPU:...

MiracleLinux 9 : vim-8.2.2637-26.el9_8.13.ML.1 (AXSA:2026-1631:22)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1631:22 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious...

CVE-2026-74709 xsk: clear metadata pointer when no timestamp is requested

In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested whe...

PT-2026-79682

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier work UAF on disconnect ipheth sndbulk callback re-arms the carrier-check work on any non-zero URB status: else schedule delayed work&dev-carrier work, 0; Nothing ties that to the interface being up, ...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A flaw was found in Vim, an open-source command-line text editor. An attacker could craft a malicious tags file that, when processed by Vim's C omni-completion feature, leads to insufficient escaping of input. This vulnerability allows for the execution of arbitrary Ex commands and, subsequently,...

CVE-2026-77072

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

CVE-2026-72495

A flaw was found in the Linux kernel's RDMA/bnxtre component. A local attacker could exploit this vulnerability by repeatedly requesting Work Completion WC pages for the same user context ucontext, exceeding the supported limit of one page per context. This could lead to concurrent access issues...

Linux Distros Unpatched Vulnerability : CVE-2026-73073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command...