`tinymember` was removed from crates.io due to affiliation with malicious code

While tinymember did not directly contain malicious code, it was owned by the same user as arone and aronenao, which contained suspicious build scripts. This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads. There were no crates depending on this crate on crates.io. T...

WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability

Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...

CVE-2026-54740

In Lemmy versions prior to 0.19.19 and 1.0.0-alpha.18, the federated ActivityPub handler CollectionRemove::receive in crates/apub/activities/src/community/collection_remove.rs omits the rank check (is_higher_mod_or_admin_check) enforced by the local API, allowing any signed ActivityPub Remove act...

EUVD-2026-62844

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-52873 Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the...

PT-2026-77205

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-72116

A flaw was found in the Linux kernel's Broadcom Controller Area Network CAN bus driver. When a CAN device is removed, the driver may fail to properly manage its receive and transmit operations. This can lead to receive filters not being correctly re-enabled after updates, preventing expected data...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

.NET: .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-72070

A flaw was found in the Linux kernel's libertastf Wi-Fi driver. This vulnerability is a use-after-free, meaning the system attempts to access memory after it has been released. This occurs when the lbtffreeadapter function, responsible for freeing adapter resources, does not properly synchronize...

BIT-DOTNET-SDK-2026-62900 .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

BIT-DOTNET-2026-62900 .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100339)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100339 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix use after free bug in qediremove In qediprobe we call qediprobe which initializes...

.NET: .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-72468

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...

CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

UBUNTU-CVE-2026-72391

In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free miibus in sfpi2cmdiobusdestroy sfpi2cmdiobuscreate allocates the I2C MDIO bus with mdioi2calloc, a plain non-devm allocation, and registers it. sfpi2cmdiobusdestroy only unregisters the bus and clears sfp-i2cm...

UBUNTU-CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

UBUNTU-CVE-2026-72116

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...