EUVD-2026-82684

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

CVE-2026-79713 Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

CVE-2026-79713

Breeze Cache (WordPress plugin, versions 1.2.5 through 2.5.14 ) is vulnerable to unauthenticated cache poisoning caused by a missing set of tracking-related query parameters in its page-cache key . Because pages requested with those parameters are still cached and served from the clean URL's cach...

CVE-2026-85271: Improper Neutralization of Input During Web Page Generation

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-52851 Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. PermissionLinkedHashMap in...

SUSE CVE-2026-89961

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated...

CVE-2026-92483 liveupdate: Remember FLB retrieve() status

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Remember FLB retrieve status LUO keeps track of successful retrieve attempts on an FLB. It does so to avoid multiple retrievals of the same FLB. Multiple retrievals cause problems because once the FLB is retrieved, th...

CVE-2026-86824

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...

CVE-2026-86824 Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...

CVE-2026-86824: Inadequate Encryption Strength

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session toke...

EUVD-2026-80561

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated...

CVE-2026-89961 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated...

CVE-2026-89961: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound page and to decide whether the current vmemmap slot should be populated...

Linux Distros Unpatched Vulnerability : CVE-2026-90028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable...

Linux Distros Unpatched Vulnerability : CVE-2026-89961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - powerpc/mm: fix wrong addrpfn tracking in compound vmemmap population vmemmappopulatecompoundpages uses addrpfn to determine the PFN offset within a compound pa...

cve-2021-35394-ecosystem

CVE-2021-35394 Ecosystem This repo exists because one exploit happens to make these botnets visible to a passive sensor — not because they're related to each other. CVE-2021-35394 Realtek SDK command injection, UDP/9034 is the entry criterion : a family is in scope because it was observed...

CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...

CVE-2026-52822 Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/id/restart, PATCH /api/timesheets/id/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked...

CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...