CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

WordPress Hummingbird Performance plugin < 3.21.2 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Hummingbird versions 3.21.2...

CVE-2026-19224

The Hummingbird Performance WordPress plugin, in versions before 3.21.2 , contains a vulnerability where network-wide settings are not restricted to network administrators. This flaw allows an administrator of any single site on a multisite network to execute arbitrary code across the entire netw...

CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106177)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106177 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Performance Schema. Supported versions that are affected are MySQL Server...

CVE-2026-19224: Improper Control of Generation of Code

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

PT-2026-85408

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-85448

MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing. A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory...

rscrypto v0.9.0

rscrypto rscrypto is a Rust library of cryptographic primitives, hashes, password hashing, and checksums. One feature model controls all of them. Portable Rust is the reference implementation. SIMD and assembly backends make it faster on supported targets. Production builds do not depend on C, FF...

kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling

A vulnerability was found in the Linux Kernel. This issue affects performance monitoring on the s390 architecture during specific CPU hotplug scenarios...

kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling

A vulnerability was found in the Linux Kernel. This issue affects performance monitoring on the s390 architecture during specific CPU hotplug scenarios...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105426)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105426 advisory. In the Linux kernel, the following vulnerability has been resolved: ntbnetdev: Use devkfreeskbany in interrupt context TX/RX callback handlers ntbnetdevtxhandler,...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process of cached performance reports stored in the build directory on the controller. An attacker can execute arbitrary code by providing maliciously crafted serialized data,...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

EUVD-2026-70140

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84670

The Jenkins Performance Plugin (version 1015.v09ca_52b_3370e and earlier) is vulnerable to an arbitrary code execution attack due to an insecure deserialization flaw. The plugin uses Java serialization to cache performance reports in the build directory on the Jenkins controller but fails to rest...

PT-2026-84793

Jenkins Performance Plugin 1015.v09ca 52b 3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on...

CVE-2026-84670: Deserialization of Untrusted Data

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...