UBUNTU-CVE-2026-80531

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-80531

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-80531 xfs: avoid UAF on sc->tempip in xrep_tempfile_create

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-80531 xfs: avoid UAF on sc->tempip in xrep_tempfile_create

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-54523 Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...

WordPress Project Manager plugin 2.1.0-4.0.6 - Unauthenticated Subscriber Account Creation vulnerability

Unauthenticated Subscriber Account Creation vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.1.0-4.0.6...

CVE-2026-74928

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

CVE-2026-14550

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...

CVE-2026-74928

The WP Project Manager WordPress plugin (versions 2.1.0–4.0.6 ) lacks an authorization check on its Trello import routes , allowing unauthenticated users to create WordPress accounts with a password the attacker already knows , effectively bypassing the site's registration setting. This was disco...

EUVD-2026-66278

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

CVE-2026-74928 WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

EUVD-2026-66274

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-19220

Forminator Forms WordPress plugin versions before 1.57.1 fail to verify that site registration is enabled on the network before creating a site signup. This allows unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it, effectively a...

CVE-2026-19220 Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

EUVD-2026-66270

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...

CVE-2026-80193

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

PT-2026-82350

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gdm (UTSA-2026-093028)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093028 advisory. gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu and...

PT-2026-82147

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the xfs component. This occurs within the xrep tempfile create function if the tempfile creation process fails after the sc-tempip variable has been...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098682)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098682 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvmarchvcpucreate fails to share the vCPU...