PT-2026-64645

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free error exists in the netpoll component during the shutdown path. The issue occurs when a pending TX worker runs in parallel with the cleanup process. Specifically, the...

CVE-2026-14586

A flaw was found in Unbound. Under heavy DNS-over-QUIC DoQ traffic, a timing discrepancy in Unbound’s libngtcp2 library can trigger an assertion failure. This causes the server to crash unexpectedly, resulting in a denial of service DoS. Mitigation Disable DNS-over-QUIC DoQ by removing or...

CVE-2026-64214

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...

CVE-2026-64214 powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...

CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...

CVE-2026-14603

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...

CVE-2026-14603 WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...

EUVD-2026-48494

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...

CVE-2026-14603

The WowOptin: Next-Gen Popup Maker WordPress plugin (versions before 1.4.38 ) is vulnerable to an improper access control flaw on a REST endpoint . This lack of proper authorization allows unauthenticated users to perform unauthorized actions, specifically the ability to disable all opt-in forms ...

PT-2026-64244

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...

PT-2026-64329

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel panic occurs when handling machine check exceptions MCE from real mode. The issue is caused by the arch irq work raise function calling preempt disable, which attempts to access...

CVE-2026-16768

A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palet...

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is setResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIVersion tested: 4.6.48.File:...

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab's image viewer allows for cross-site scripting XSS when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution RCE on the JupyterLab server. Impact This vulnerability allows for arbitrary...

bernn (>=0.1.0, <=0.3.2), jupyterlab-disable-download (0.1.7) +1 more potentially affected by CVE-2026-73415 via jupyterlab (3.6.6)

jupyterlab PYPI version 3.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - bernn =0.1.0, =0.3.4, =0.8.0 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

bernn (>=0.1.0, <=0.3.2), jupyterlab-disable-download (0.1.7) +1 more potentially affected by CVE-2026-73626 via jupyterlab (3.6.6)

jupyterlab PYPI version 3.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - bernn =0.1.0, =0.3.4, =0.8.0 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

Authorization Bypass Through User-Controlled Key

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SSO instance-role provisioning. An attacker can gain full administrative privileges by manipulating the instance-role claim issued by the...

kernel security, bug fix, and enhancement update

6.12.0-211.37.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

GHSA-G9G6-QHRC-P3QC Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...