DEBIAN-CVE-2026-90076

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...

CVE-2026-54677 Scoold: Authenticated user can post replies and comments to private-space questions without space membership

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply...

CVE-2026-86863

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CVE-2026-76781

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...

UBUNTU-CVE-2026-76781

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...

CVE-2026-93154 RDMA/irdma: Add refcounting to user ring MRs

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

CVE-2026-93154

CVE-2026-93154 is a use-after-free vulnerability in the Linux kernel's RDMA/irdma subsystem. The root cause is the absence of refcounting on user-space ring Memory Regions (MRs) : userspace could deregister the MRs backing QP, CQ, or SRQ rings while they were still in use. The fix bumps the MR's ...

CVE-2026-93154 RDMA/irdma: Add refcounting to user ring MRs

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

CVE-2026-90231 apparmor: fix unconfined user namespace restriction forced stack

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

CVE-2026-74017

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

Microsoft Container Registry Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-81517

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-74017

WordPress User Registration plugin versions ≤ 5.2.7 contain an unauthenticated Broken Access Control vulnerability. The flaw allows a remote attacker with no prior privileges to access data they should not, resulting in a low confidentiality impact with no impact on integrity or availability. The...

CVE-2026-74017 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-74017 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.checkuser/2 decides whether the attribute named by...

CVE-2026-92918

admin3 through 3.0.0 discloses user session tokens in the audit log event body when publishing UserLoggedIn domain events. The root cause is that DefaultSessionService persists the session token into the log entry, making it retrievable via the GET /logs endpoint by any user with log:view permiss...

CVE-2026-92918 admin3 through 3.0.0 Session Token Disclosure via Audit Log

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

CVE-2026-92918 admin3 through 3.0.0 Session Token Disclosure via Audit Log

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...