Amazon Linux 2023 : composer (ALAS2023-2026-2152)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2152 advisory. Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the...

PT-2026-91436

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication...

PT-2026-91748

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynami...

CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-88912: Authorization Bypass Through User-Controlled Key

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-89671

A flaw was found in the Linux kernel's Network File System version 3 NFSv3 server daemon nfsd. The nfsd3procsetacl function unconditionally processes Access Control List ACL update requests, even when the client's request does not specify an ACL to be set. A remote attacker could exploit this by...

CVE-2026-89534

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when the system attempts to handle an RDMA Remote Direct Memory Access address change, and a critical memory allocation fails. This can lead to a 'use-after-free' error, where the system tries to access memory that h...

CVE-2026-81912

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

EUVD-2026-76243

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-77159

A symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm log file without validating for symbolic links. A local attacker with access to the swtpm account can replace the log file with a symlink, causing the root-level libvirtd daemon ...

PT-2026-90250

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sc cm id when ADDR CHANGE replacement fails When svc rdma listen handler handles RDMA CM EVENT ADDR CHANGE, it creates a replacement listener cm id and returns 1, telling the CM core to destroy the old one. If the...

CVE-2026-89747: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...

PT-2026-90149

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

Linux Distros Unpatched Vulnerability : CVE-2026-88265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's...

CVE-2026-81905: Incorrect Authorization

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

CVE-2026-45764

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash,...

CVE-2026-45764

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash,...

UBUNTU-CVE-2026-45764

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash,...