CVE-2026-10033

The CVE concerns the WordPress plugin EventON Action User, affected up to version 2.5.14. The underlying issue is an authorization bypass in an action (evoau_save_capability AJAX action) that allows unauthenticated attackers to grant EventON management capabilities and the upload_files capability...

PT-2026-64356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The rockchip GPIO driver contains several teardown issues and resource leaks within its remove path and error handling. Specifically, the debounce clock bank-db clk is obtained via of cl...

CVE-2026-15630

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-15630

Technical details about CVE-2026-15630 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15630 CVE-2026-15630

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

NPM: Next.js: Unbounded Server Action payload in Edge runtime

NPM: Next.js: Unbounded Server Action payload in Edge runtime vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

Insertion of Sensitive Information Into Sent Data

Overview next is a react framework. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in action-handler.ts and action-utils.ts. An attacker can enumerate internal Server Action IDs by sending crafted Next-Action requests or probing client-served...

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

Important: Red Hat Security Advisory: evince security update

An update for evince is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

PT-2026-63558

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Applications using App Router, Server Actions use server, or use cache endpoints may disclose these endpoints, bypassing authentication on the pages...

PT-2026-63561

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption when that Server Action...

CVE-2026-63982

A flaw was found in the Linux kernel's network scheduler component. This vulnerability occurs when the mirred action, used for redirecting network traffic, fails to properly detect a redirection loop. An attacker can exploit this by crafting specific network configurations that cause packets to b...

GHSA-G9G6-QHRC-P3QC Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

SUSE CVE-2026-63981

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact checks schedmirrednest against MIRREDNESTLIMIT 4 to prevent deep recursion. However, when the action uses blockcast tcfmblockid != 0, the...

Important: Red Hat Security Advisory: evince security update

An update for evince is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

EUVD-2026-46167

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...