EUVD-2026-38057

Statamic CMS's unsafe method invocation via collection sorting allows data destruction...

CVE-2026-49869

creationtimestamp| type| source ---|---|--- 2026-06-26 21:55:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wpquuw42c 2026-06-26 22:48:16+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mp7znrg3ri2v 2026-06-27 17:01:02+00:00| seen|...

CVE-2026-53303

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extensionlist reading with sblock in f2fssbishow In f2fssbishow, the extensionlist, extensioncount and hotextcount are read without holding sbi-sblock. If a concurrent sysfs store modifies the extension list via...

UBUNTU-CVE-2026-53279

In the Linux kernel, the following vulnerability has been resolved: drm/gma500/oaktraillvds: fix hang on init failure The LVDS init code looks up an I2C adapter using i2cgetadapter and tries to read the EDID before falling back to allocating and registering its own adapter. The error handling doe...

UBUNTU-CVE-2026-53284

In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes WARNING With extra warning on dirty extent buffers at umount aka, the next patch in the series, test case generic/388 can trigger the following warning about dir...

EUVD-2026-39856

In the Linux kernel, the following vulnerability has been resolved: iouring/napi: cap busypollto 10 msec Currently there's no cap on the maximum amount of time that napi is allowed to poll if no events are found, which can lead to kernel complaints on a task being stuck as there's no conditional...

CVE-2026-53303

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extensionlist reading with sblock in f2fssbishow In f2fssbishow, the extensionlist, extensioncount and hotextcount are read without holding sbi-sblock. If a concurrent sysfs store modifies the extension list via...

BELL-CVE-2026-54679

Bulletin has no description...

CVE-2026-47206

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.errorreply in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing...

CVE-2026-45406

Technical details are not publicly available in the provided documents; monitor for updates.

DRUPAL-CONTRIB-2026-064

The Tealium iQ Tag Management module provides Drupal integration with Tealium iQ. tealiumiq stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an Object Injection vulnerability when the data are unserialized. This...

CVE-2026-57648

Contributor Broken Access Control in Nelio Content = 4.3.4 versions...

EUVD-2026-39667

Contributor SQL Injection in Contest Gallery = 30.0.0 versions...

CVE-2026-57649

The CVE concerns the WordPress Shoppable Images Lite plugin (versions

EUVD-2026-39750

Contributor Insecure Direct Object References IDOR in PPWP = 1.9.19 versions...

EUVD-2026-39726

Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...

MINI-R7J7-8J2R-6565

Bulletin has no description...

MINI-HXJ3-X9VP-6VJ9

Bulletin has no description...

MINI-Q84F-6FHF-GV7J

Bulletin has no description...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs bsc1266290. CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work...