EUVD-2026-45886

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders...

CVE-2026-12972 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders...

CVE-2026-11868 WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...

CVE-2026-11868

CVE-2026-11868 concerns the WordPress plugin WP Travel (before version 11.7.1). The issue is that the plugin does not perform capability or ownership checks on its booking cancellation action, which is exposed to unauthenticated users, allowing them to cancel arbitrary bookings on affected sites....

MINI-MW75-J87C-57J5

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2026-64206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: L2CAP: cancel pendingrxwork before taking conn-lock l2capconndel takes conn-lock and then calls cancelworksync for pendingrxwork. processpendingrx...

Linux Distros Unpatched Vulnerability : CVE-2026-64059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances,...

Linux Distros Unpatched Vulnerability : CVE-2026-64054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request netshapernlgroupdoit does not...

Linux Distros Unpatched Vulnerability : CVE-2026-63930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to itera...

Linux Distros Unpatched Vulnerability : CVE-2026-63945

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads...

Linux Distros Unpatched Vulnerability : CVE-2026-63863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to...

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

PT-2026-61563

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description A denial of service issue exists in the RPC use handler that causes a panic when the db variable is set without a namespace. Unauthenticated attackers can crash the server process by sending a...

Linux Distros Unpatched Vulnerability : CVE-2026-53367

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the...

Linux Distros Unpatched Vulnerability : CVE-2026-63947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that...

Linux Distros Unpatched Vulnerability : CVE-2026-63958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM...

Linux Distros Unpatched Vulnerability : CVE-2026-63851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v4.0.5 enc ring VCN encoder and decoder rings do not...

Linux Distros Unpatched Vulnerability : CVE-2026-64040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfsmkdir fails When vfsmkdir fails, the error code is not...

Linux Distros Unpatched Vulnerability : CVE-2026-64173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never...

Linux Distros Unpatched Vulnerability : CVE-2026-63968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fix possible infinite loop in fib6selectpath Found while auditing the same pattern Sashiko reported in rt6fillnode 1. Apply the same fix as commit...