CVE-2026-77035

Joomla Event Manager (joomlaeventmanager.net) versions prior to 5.0.1 are affected by a cross-user event and venue takeover vulnerability. A registered user with edit-own rights (via the eventowner=1 setting or core.edit.own permission) can forge form fields by POSTing another user's record ID to...

CVE-2026-77035 Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...

EUVD-2026-66863

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...

CVE-2026-77035 Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...

SUSE CVE-2026-74753

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

CVE-2026-30050

An issue in the ModifyAMFEventSubscriptionProcedure function processor/eventexposure.go of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PATCH request...

CVE-2026-30050

free5gc v4.1.0 , an open-source 5G Core implementation, is affected by a Denial of Service vulnerability in the ModifyAMFEventSubscriptionProcedure function located in processor/event_exposure.go. An unauthenticated attacker can trigger the DoS by supplying a crafted PATCH request over the networ...

AZL-97778 CVE-2026-74753 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098753)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098753 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events...

PT-2026-82281

Name of the Vulnerable Software and Affected Versions ZoneMinder affected versions not specified Description An authenticated OS command injection issue exists in the event export functionality. An authenticated user with View Events permission can execute arbitrary operating system commands on t...

The vulnerability of the evbuffer_add_buffer_reference() function in the Libevent event-driven library allows a attacker to cause a service failure.

The vulnerability of the evbufferaddbufferreference function in the Libevent event-driven library is related to the use of uninitialized resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-82133

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where perf event open accepts events in the EXIT state as group leaders because early validation only rejects REVOKED and DEAD events. This occurs aft...

The vulnerability of the bufferevent_socket_set_conn_address_() function in the Libevent asynchronous event library allows a hacker to cause a service failure.

The vulnerability of the buffereventsocketsetconnaddress function in the Libevent asynchronous event library is related to writing beyond the buffer’s boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098937)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098937 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with...

EUVD-2026-66111

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

GHSA-XX4J-W367-7247 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Impact djust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated loginrequired / permissionrequired, or an onmount hook that returns a redirect and the connecting user is not authorized, the consumer sent the client a "type":"navigate","to":... redirect frame and then...

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

Impact djust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated loginrequired / permissionrequired, or an onmount hook that returns a redirect and the connecting user is not authorized, the consumer sent the client a "type":"navigate","to":... redirect frame and then...

CVE-2026-55571

djust , a Phoenix LiveView-style reactive server-side rendering library for Django, is vulnerable to an authentication bypass in versions prior to 1.0.4 . When LiveViewConsumer.handle_mount denies a mount via login_required, permission_required, or a redirecting on_mount hook, it sends a navigate...

CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

CVE-2026-74633

A flaw was found in the Linux kernel's tracing module. A local user can trigger a NULL pointer dereference by attempting to remove a specific event filter for an unloaded module. This vulnerability arises when a module-only event filter is cached with a null match, and a subsequent write operatio...