CVE-2026-40935

WWBN/AVideo (versions ≤ 29.0) is affected by a CAPTCHA bypass involving objects/getCaptcha.php. The ql parameter is read directly from the query string without clamping or sanitization, allowing an unauthenticated client to request a 1-character CAPTCHA word. Coupled with a case-insensitive strca...

CVE-2026-40935 WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/getCaptcha.php accepts the CAPTCHA length ql directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011030)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011030 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: rockchip: Fix memory leak in rockchipclkregisterpll If clkregister fails, @pll-ratetable may...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011017)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011017 advisory. In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when register device failed in addmtddevice There is a kmemleak when...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013239)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013239 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix nsfd startup race again Commit bd5ae9288d64 nfsd: register pernet ops last, unregister...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011123 advisory. In the Linux kernel, the following vulnerability has been resolved: class: fix possible memory leak in classregister If classaddgroups returns error, the 'cp-subsys'...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013337)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013337 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: set dormant flag on hook register failure We need to set the dormant flag...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010823)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010823 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: st: Fix memory leak in stofquadfssetup If stclkregisterquadfspll fails, @lock should be free...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011022)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011022 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: i2sbus: fix possible memory leak in i2sbusadddev devsetname in soundbusaddone allocate...

Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata

Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of certain client metadata fields when explicitly enabled. An attacker possessing a valid Initial Access Token can dynamically register a malicious client with crafted metadata. Depending on...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011072)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011072 advisory. In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: scmi: Fix genpd leak on provider registration failure If ofgenpdaddprovideronecell...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010815 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix cleanup after devsetname If devsetname fails, we leak nvmem-wpgpio as the cleanu...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013073 advisory. In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: scmi: Fix genpd leak on provider registration failure If ofgenpdaddprovideronecell...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006907)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006907 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: rockchip: Fix memory leak in rockchipclkregisterpll If clkregister fails, @pll-ratetable may...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011049)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011049 advisory. In the Linux kernel, the following vulnerability has been resolved: perf/smmuv3: Fix hotplug callback leak in armsmmupmuinit armsmmupmuinit won't remove the callback...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010979)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010979 advisory. In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible name leak in ocxlfileregisterafu If deviceregister returns error in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013029)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013029 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bcsp: receive data only if registered Currently, bcsprecv can be called even when the...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011098)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011098 advisory. In the Linux kernel, the following vulnerability has been resolved: cxl: fix possible null-ptr-deref in cxlguestinitafu|adapter If deviceregister fails in...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006983)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006983 advisory. In the Linux kernel, the following vulnerability has been resolved: cxl: fix possible null-ptr-deref in cxlguestinitafu|adapter If deviceregister fails in...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010868)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010868 advisory. In the Linux kernel, the following vulnerability has been resolved: vme: Fix error not catched in fakeinit In fakeinit, rootdeviceregister is possible to fail but it...