PT-2026-96591

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

UBUNTU-CVE-2026-87933

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtilsMergePatch of the file cJSONUtils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to...

CVE-2026-86806 opengeos GeoLibre _is_within_roots server-side request forgery

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function iswithinroots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name:...

EUVD-2026-72650

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...

UBUNTU-CVE-2026-86227

A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high...

AZL-99819 CVE-2026-19931 affecting package rust 1.75.0-30

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053321)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053321 advisory. In the Linux kernel, the following vulnerability has been resolved: erofs: fix pcluster use-after-free on UP platforms During stress testing with CONFIGSMP disabled,...

PT-2026-85095

Contributor PHP Object Injection in RTMKit = 2.1.5 versions...

WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Under Construction versions = 5.82...

CVE-2026-81778

Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...

PT-2026-83638

Name of the Vulnerable Software and Affected Versions Open Asset Import Library Assimp versions prior to 6.0.3 Description A heap-based buffer overflow occurs when manipulating the iNewIndex argument within the MD5Importer::MakeDataUnique function located in the code/AssetLib/MD5/MD5Loader.cpp...

WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Smart Marketing SMS and Newsletters Forms versions = 5.1.24...

CVE-2026-80716

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after scheduletimeout removes it only if that peer is still found in the caller's...

PT-2026-83156

Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...

CVE-2026-78271

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

CVE-2026-32550

Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...

EUVD-2026-66944

Unauthenticated SQL Injection in Beautiful Taxonomy Filters = 2.4.6 versions...

PT-2026-82469

Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...

PT-2026-82457

Name of the Vulnerable Software and Affected Versions Fluent Boards Pro versions prior to 2.0.12 Description An issue allows an editor to perform arbitrary file deletion within the application. Recommendations Update to version 2.0.12 or later...

EUVD-2026-66664

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...