CVE-2026-20515: Use After Free

In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11122991; Issue ID: MSV-8132...

CVE-2026-75650: Improper Neutralization of Special Elements Used in a Template Engine

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

CVE-2026-86292: Missing Authentication for Critical Function

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. Th...

PT-2026-86596

In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01810811; Issue ID: MSV-9232...

CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99752 CVE-2026-19931 affecting package curl 8.11.1-11

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

AZL-99777 CVE-2026-19931 affecting package cmake 3.30.3-15

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2026-86255

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

CVE-2026-86254

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

EUVD-2026-72110

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

CVE-2026-75793

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053389)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053389 advisory. In the Linux kernel, the following vulnerability has been resolved: memcgwriteeventcontrol: fix a user-triggerable oops we are not guaranteed that anything past the...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-022284)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022284 advisory. Unity Link Advisory UTSA-2026-022284 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073361 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxf...

CVE-2026-86181: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be...

CVE-2026-13159: Missing Authorization

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user w...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053326 advisory. In the Linux kernel, the following vulnerability has been resolved: cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns What we want is to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053420)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053420 advisory. In the Linux kernel, the following vulnerability has been resolved: inetdiag: fix kernel-infoleak for UDP sockets KMSAN reported a kernel-infoleak 1, that can...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053371)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053371 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCPUSERTIMEOUT, and the other pee...

PT-2026-86479

A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The manipulation of the argument user name results in sql injection. The attack can be executed remotely. The exploit has been released to the...