CVE-2026-17555: Improper Neutralization of Special Elements used in an SQL Command

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the exportdata parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values a...

WordPress WPvivid — Backup, Migration & Staging plugin <= 0.9.131 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WPvivid Backup and Migration versions = 0.9.131...

WordPress Demi – One Click Demo Import, Backup & Site Migration plugin <= 0.0.7 - Unauthenticated Arbitrary Directory Deletion vulnerability

Unauthenticated Arbitrary Directory Deletion vulnerability discovered by Spy0x7 in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions = 0.0.7...

WordPress Demi plugin < 0.0.7 - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure vulnerability

WordPress Demi plugin 0.0.7 - One Click Demo Import, Backup & Site Migration 0.0.7 - Unauthenticated Sensitive Data Exposure vulnerability discovered by Pavan N in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions 0.0.7...

PT-2026-75900

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.3.0 Description When migrating an instance to another cluster member, user-supplied configuration overrides are applied without project restriction enforcement. This allows a restricted project user to manipulate...

SUSE CVE-2026-22874

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering...

SUSE CVE-2026-52805

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery SSRF vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated...

EUVD-2026-50552

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

CVE-2026-67433 Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

CVE-2026-67433

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

CVE-2026-67433

CVE-2026-67433 affects Linuxfabrik monitoring-plugins (Python plugins for Icinga/Nagios). In version 6.0.0, the logfile check legacy database migration used a predictable path under /tmp via os.rename(), enabling a local user with plugin-account access to place a symlink that is followed by sqlit...

CVE-2026-67433 Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

CVE-2026-67433 Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.29.1 Release.

Red Hat OpenShift Dev Spaces 3.29.1 has been released. Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.29 release is based on...

CVE-2026-64374

A flaw was found in the Linux kernel's real-time RT scheduler. In non-real-time configurations, the RTPUSHIPI mechanism, designed to improve task migration, can lead to a live lock. This occurs when a CPU handling heavy network traffic is repeatedly interrupted by other CPUs attempting to schedul...

CVE-2026-64436

A flaw was found in the Linux kernel. An uninitialized variable in the IPComp IP Compression state handling could allow a local attacker to trigger an out-of-bounds read during state migration. This vulnerability could lead to the disclosure of sensitive kernel memory or cause a denial of service...

CVE-2026-64514

A flaw was found in the Linux kernel's userfaultfd mechanism. This vulnerability occurs when the userfaultfdmustwait and userfaultfdhugemustwait functions incorrectly read Page Table Entries PTEs without proper locking during memory operations. This can lead to an undefined state if a page is bei...

CVE-2026-64474

A flaw was found in the Linux kernel's Virtual Function I/O VFIO device migration feature. The vfiomiggetnextstate function, responsible for managing device migration states, contains an infinite loop. This occurs when processing certain blocked transitions, causing the system to hold a driver...

PT-2026-65901

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

CVE-2026-15012: Exposure of Sensitive Information to an Unauthorized Actor

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...