EUVD-2026-66568

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to pyOpenSSL

Summary pyOpenSSL is used by IBM Integrated Analytics System as a Python wrapper around the OpenSSL library for SSL/TLS functionality. Multiple vulnerabilities affect pyOpenSSL versions prior to 26.0.0. CVE-2026-27448 involves a "fail open" behavior where an unhandled exception in a user-provided...

CVE-2026-74851

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

EUVD-2026-66277

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-74851

The Pods WordPress plugin in versions before 3.3.9.1 is vulnerable to Remote Code Execution (RCE) . The root cause is a failure to correctly compare a display callback against a list of blocked functions . This flaw allows users with the author role or higher to execute arbitrary code on the serv...

CVE-2026-74851 Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-14216 Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks...

SUSE CVE-2026-74262

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITEONCE when changing lower socket callbacks kcmattach replaces a live lower TCP socket's skdataready and skwritespace callbacks with KCM handlers, and kcmunattach restores them later. Those callback-pointer updates ar...

SUSE CVE-2026-74302

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix UAF in hciunregisterdev hciunregisterdev does not disable cmdtimer and ncmdtimer before the hcidev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory...

PT-2026-82135

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn component where crypto completion callbacks do not properly manage references to the key-slot and peer. Specifically, the peer reference pins the netdev, and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098996)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098996 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates its temporary auth/ICV layout...

PT-2026-82118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the regmap sdw mbq poll busy function where the system attempts to call the readable reg callback without verifying if it is set. Because this callback is optional,...

PT-2026-81957

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104610)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104610 advisory. In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses ...

Linux Distros Unpatched Vulnerability : CVE-2026-74738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which i...

Linux Distros Unpatched Vulnerability : CVE-2026-80519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev,...

Linux Distros Unpatched Vulnerability : CVE-2026-74750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU...

CVE-2026-74750: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: cryptofreeaead...

CVE-2026-80519: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...