CVE-2026-87719 Deserialization of Untrusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

EUVD-2026-76739

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

PT-2026-90638

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-87759: Improper Privilege Management

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

Linux Distros Unpatched Vulnerability : CVE-2026-54258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated...

CVE-2026-87797: Missing Authorization

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

PT-2026-90582

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisi...

CVE-2026-77005: External Control of File Name or Path

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can...

CVE-2026-90545: Missing Authorization

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid...

PT-2026-90557

Name of the Vulnerable Software and Affected Versions CODE MONKEYS PROPOSALS versions prior to 1.0.2 Description The plugin fails to validate user-supplied file paths before performing file deletion and does not verify the permissions of the user making the request. This allows any authenticated...

CVE-2026-84023: Cross-Site Request Forgery (CSRF)

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page...

CVE-2026-89767

A flaw was found in the Linux kernel's overlay file system overlayfs. An unprivileged local user can trigger a specific error condition during the creation of a new directory. This error causes the system to incorrectly release a lock on the parent directory and a reference to the new directory...

CVE-2026-89483

A flaw was found in the Linux kernel's Non-Volatile Memory Express NVMe subsystem. Under specific memory pressure conditions, a local user could trigger a scenario where uninitialized kernel memory is used and potentially exposed. This could lead to information disclosure, revealing sensitive dat...

CVE-2026-89604

A flaw was found in the Linux kernel's efivarfs component. An unprivileged local user can exploit this by repeatedly calling the statfs handler on the efivarfs mount point. This action triggers a flood of calls to the QueryVariableInfo runtime service, which is particularly costly on x86 systems...

CVE-2026-89460

A flaw was found in the Linux kernel. A local user can trigger a kernel panic by running the perf stat command while CPUs are being hotplugged. This occurs because the system fails to properly allocate CPU event structures for newly online CPUs, leading to a null pointer dereference. Successful...

CVE-2026-81013

A flaw was found in the hp-bioscfg component of the Linux kernel. A local user could trigger a heap out-of-bounds read by writing an empty string to the currentpassword or newpassword fields. This occurs because the validatepasswordinput function attempts to access memory before the allocated...

CVE-2026-80964

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture virmidi driver. This vulnerability allows a local user to trigger an out-of-bounds access by manually binding a device via the sysfs interface with an invalid card index. This can lead to system instability or potential...

CVE-2026-89507

A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the ucmawritecmevent function where it re-reads a critical file pointer multiple times without proper locking. This allows another function, ucmamigrateid, to change the file pointer mid-operation. An...

CVE-2026-80929

A flaw was found in the Linux kernel. A non-root user can exploit a vulnerability in the sysctl mechanism, specifically related to the cadpid entry. By unsharing process ID PID and user namespaces, a local attacker can modify this global system control from a child namespace. This allows a user...