WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

PT-2026-63337

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer access function job events, workflow events, ad hoc command events. Three event groups - inventory update events, project update events, and system job...

ALSA-2026:43307 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final completions race against each other CVE-2026-23110...

CVE-2026-8983

creationtimestamp| type| source ---|---|--- 2026-07-21 22:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6smphxx22y 2026-07-21 22:08:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6t3pjvux23 2026-07-22 01:30:28+00:00| seen|...

CVE-2026-64877

creationtimestamp| type| source ---|---|--- 2026-07-21 19:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6lowlm3s2i 2026-07-21 20:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr6lxd6i4z2a 2026-07-21 23:47:46+00:00| seen|...

CVE-2026-63868

A flaw was found in the Linux kernel's Generic Attribute Registration Protocol GARP network component. A remote attacker could send specially crafted GARP attributes, leading to an unsigned integer underflow during attribute parsing. This underflow causes the system to incorrectly process attribu...

CVE-2026-64018

A flaw was found in the Linux kernel's mana network driver. In Confidential Virtual Machines VMs, a missing bounds check when processing network events can allow a malicious hardware component or a compromised VM to write data outside of an intended memory region. This out-of-bounds access could...

📄 WordPress Community Events 1.5.1 Unauthenticated Blind SQL Injection

WordPress Community Events plugin version 1.5.1 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

CVE-2026-57308

CVE-2026-57308 is an SQL injection in Apache Syncope where an administrator can trigger arbitrary SQL through unsanitized sort parameters via stacked queries. Affected versions: 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, and 4.1.0-M0–4.1.1. Upgrading to 4.0.7 or 4.1.2 mitigates the issue. The impact is hig...

CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

CVE-2026-11349 Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...

CVE-2026-11349

The CVE concerns the Modern Event Calendar plugins for WordPress (Pro and Lite) before version 7.34.0, where an unauthenticated AJAX action uses an unsanitized request parameter in a SQL statement, causing an unauthenticated SQL injection. Root cause: lack of sanitization/escaping of the paramete...

CVE-2025-8412

creationtimestamp| type| source ---|---|--- 2026-07-20 05:17:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr2k5ssvac2u 2026-07-20 05:18:00+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mr2k5tfv2525...

CVE-2026-64013

In the Linux kernel, the following vulnerability has been resolved: ACPI: button: Fix ACPI GPE handler leak during removal Commit a7e23ec17fee "ACPI: button: Install notifier for system events as well" changed the ACPI notify handler type for ACPI buttons to ACPIALLNOTIFY, but it forgot to update...

CVE-2026-63868

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

EUVD-2026-45553

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

CVE-2026-53370

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Improve validation and configuration of ACR masks Currently there are several issues on the user space ACR mask validation and configuration. - The validation for user space ACR mask attr.config2 is incomplete,...

CVE-2026-9323

creationtimestamp| type| source ---|---|--- 2026-07-18 14:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqwicdxykb2z 2026-07-18 15:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwjrntoau2w 2026-07-18 16:39:55+00:00| seen|...