Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: core: Prevent invalid memory access when there is no parent device. The commit 813665564b3d “iio: core: Convert to use the firmware node handle instead of the OF node” changed the type of nodes used for label retrieval in...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: ipr: Fixed a warning in iprinit. iprinit will not call unregisterrebootnotifier when pciregisterdriver fails, which causes a warning. Call unregisterrebootnotifier when pciregisterdriver fails. The notification callback...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iavf: Error handling in iavfinitmodule has been fixed. The iavfinitmodule no longer destroys the workqueue when pciregisterdriver fails. Instead, call destroyworkqueue when pciregisterdriver fails to prevent resource leaks. This...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Set lineeventstate::irq after the IRQ register is successfully set. When running the gpio test on the nxp-ls1028 platform using the following command: gpiomon --num-events=3 --rising-edge gpiochip1 25 A warning...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: um: virtiouml: Fixed a use-after-free after putdevice in probe. When registervirtiodevice fails in virtioumlprobe, the code sets vudev-registered = 1, even though the device was not successfully registered. This can lead to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pps: Fix warning in ppsregistercdev when device creation fails Similar to the previous commit 2a934fdb01db, the release hook should be set before deviceregister. Otherwise, when deviceregister returns an error and putdevice...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fpga: bridge: Added a module owner field and used its pointer to count the reference count of the module. The current implementation of the fpgabridge assumes that the low-level module registers a driver for the parent device...

PT-2026-80923

Name of the Vulnerable Software and Affected Versions rConfig versions 8.0.0 through 8.2.12 Description An authentication bypass exists due to a duplicate Auth::routes call in the routes/web.php file, which inadvertently re-enables the POST /register endpoint after it had been disabled. This allo...

PT-2026-80802

Name of the Vulnerable Software and Affected Versions itsourcecode Online Pharmacy System version 1.0 Description An unrestricted file upload flaw exists in the User Registration component. A remote attacker can manipulate the photo argument within the move uploaded file function in the 'all...

EUVD-2026-64635

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

CVE-2026-13598 RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

CVE-2026-13598

CVE-2026-13598 affects the RestrictMate WordPress plugin in versions prior to 1.3.0 . The root cause is that the plugin does not restrict the user role supplied during account registration, enabling an unauthenticated attacker to create a new administrator account and immediately obtain a logged-...

CVE-2026-19222

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

CVE-2026-19222

CVE-2026-19222 is an authenticated privilege escalation vulnerability in the Forminator Forms WordPress plugin, affecting versions prior to 1.57.0.7 . The plugin does not consistently enforce the role restriction it applies to registration forms. A user who is permitted to build forms can configu...

CVE-2026-19222 Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

CVE-2026-19222 Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

EUVD-2026-64222

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

PT-2026-79513

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it...

CVE-2026-48105

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

EUVD-2026-64192

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...