PT-2026-69839

Name of the Vulnerable Software and Affected Versions systemd-machined versions 258 through 259 and later Description When running on a desktop system, an unprivileged user logged into a desktop graphical session can terminate arbitrary processes, including those with higher privileges. This issu...

CVE-2026-18470: Exposure of Sensitive Information to an Unauthorized Actor

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including...

PT-2026-69693

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow exists in the net/mlx5 component. When a device advertises the mcia 32dwords capability, the MCIA register can return up to 32 dwords 128 bytes. However, the mlx5 ifc...

Linux Distros Unpatched Vulnerability : CVE-2026-68293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords 128 bytes when the device advertises the mcia32dwords...

PT-2026-69816

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free and a WARN ON condition exist in the add mtd device error paths. When device register or mtd nvmem add fails, the error handling triggers mtd release via put device or devi...

PT-2026-69371

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2 Description When the verification-code reset mode is enabled, the plugin fails to enforce password reset attempt limits using a server-derived value. Instead, it relies on client-controlled data f...

CVE-2026-68274: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

Exploit for Incorrect Authorization in Apache Polaris

CVE-2026-64640 — Apache Polaris: credential vending before loc...

EUVD-2026-53869

Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST...

CVE-2026-70556

Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a...

WordPress Login & Register Forms plugin < 3.2.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Login/Signup Popup versions 3.2.5...

CVE-2026-64640

Apache Polaris is affected by a storage-location validation flaw during table/view registration. An authenticated user with table- or view-registration privileges could trigger Polaris to use the catalog’s storage credentials to read a caller-supplied Iceberg metadata file before confirming it li...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-64604

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU...

CVE-2026-64604

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU...

CVE-2026-64588

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring-ready On weakly-ordered architectures, the store to fiq-ops can be reordered past the store to ring-ready, allowing a CPU that sees ring-ready == true via fuseuringready to dispatch requests...

The vulnerability of the uacce_register() function in the drivers/misc/uacce/uacce.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the uacceregister function in the drivers/misc/uacce/uacce.c module of the Linux kernel is related to the lack of checking for the return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-68749

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description The registration handler at the endpoint POST /api/auth/register/userId fails to validate that the userId provided in the URL corresponds to the email address associated with the registration...

CVE-2026-48087: Improper Authentication

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...