CVE-2026-89764: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-45767 Suricata datasets: save to absolute filename can be bypassed when combined with load command

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some...

EUVD-2026-75227

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

CVE-2026-18351: Unrestricted Upload of File with Dangerous Type

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

patchright v1.63.0

🎭 Patchright Patchright is a patched and undetected version of the Playwright Testing and Automation Framework. It can be used as a drop-in replacement for Playwright. !NOTE This repository serves the Patchright Driver. To use Patchright, check out the Python Package, the NodeJS Package or the...

CVE-2026-18021: Improper Control of Generation of Code

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-86420

ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001472)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001472 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when...

Numeric Truncation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Numeric Truncation Error in the interceptors.dump interceptor, which, for a chunked response with no Content-Length, does not abort an oversized body but terminates after...

CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

CVE-2026-80846

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

The vulnerability of the pipapo Drop() function in the net/netfilter/nft_set_pipapo.c module of the netfilter component in the Linux operating system’s kernel allows a hacker to induce a service failure.

The vulnerability of the pipapo Drop function in the net/netfilter/nftsetpipapo.c module of the netfilter component in the Linux operating system’s kernel is related to insufficient protection for service data. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-85724

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handle esp restores skb-dev from the saved skb iif before passing the packet into the XFRM input path. Queued TCP data ca...

Malicious code in megan-baileys (npm)

megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response ...

MAL-2026-15919 Malicious code in megan-baileys (npm)

megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response ...

SUSE CVE-2026-72418

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: prevent connlimit drops for early confirmed ct Commit 69894e5b4c5e "netfilter: nftconnlimit: update the count if add was skipped" introduced a regression where packets for valid connections are dropped whe...

Linux Distros Unpatched Vulnerability : CVE-2026-80683

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via...

PT-2026-83013

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring subsystem where per-task restrictions are not preserved across an exec operation. When a task that has used io uring undergoes the exec cancellation path,...

CVE-2026-54552

A flaw was found in sh, a Python library for process launching. When sh runs from an elevated process and launches a command with the uid option set to an unprivileged user, the child process may retain the parent process's supplementary groups. This incomplete privilege drop can allow the child...