CVE-2025-11877 User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ualshookwploginfailed' lacks a capability check and writes failed usernames directly into updateoption calls. This makes it possible for unauthenticated attacker...

CVE-2025-11877 User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ualshookwploginfailed' lacks a capability check and writes failed usernames directly into updateoption calls. This makes it possible for unauthenticated attacker...

CVE-2025-11877

The CVE-2025-11877 issue affects WordPress User Activity Log versions up to 2.2. The vulnerability is in the failed-login handler (ual_shook_wp_login_failed), which lacks a capability check and writes failed usernames into update_option() calls. This allows unauthenticated attackers to push certa...

WordPress User Activity Log plugin <= 2.2 - Unauthenticated Limited Options Update via Failed Login vulnerability

Unauthenticated Limited Options Update via Failed Login vulnerability discovered by shark3y in WordPress Plugin User Activity Log versions = 2.2...

WordPress plugin User Activity Log 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability...

PT-2026-1584

Name of the Vulnerable Software and Affected Versions User Activity Log plugin versions prior to and including 2.2 Description The User Activity Log plugin has an issue where the failed-login handler ual shook wp login failed does not perform a capability check. This allows unauthenticated...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000505)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000505 advisory. In the Linux kernel, the following vulnerability has been resolved: md/raid1: properly indicate failure when ending a failed write request This patch addresses a dat...

mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals

An integer overflow flaw has been discovered in the Apache HTTP server. The integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff timer becoming 0. Attempts to renew the certificate then are repeated...

Improper Control of Interaction Frequency

Overview django-phone-verify is an A Django app to support phone number verification using security code sent via SMS. Affected versions of this package are vulnerable to Improper Control of Interaction Frequency due to the absence of failed attempt tracking and lockout mechanisms in the...

PT-2026-6180

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition exists within the SCSI layer of the Linux kernel that can prevent the error handler from being woken up, leading to stuck I/O operations. This occurs due to memory...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993184)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993184 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993173 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion BUG Syzbot reported ...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993089)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993089 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2stackglueinit ocfs2tableheader should be free in ocfs2stackglueini...

CVE-2022-50855

The CVE-2022-50855 entry concerns a Linux kernel issue where the BPF LSM program attached via bpf_prog_attach to cgroups could leak because the refcnt wasn’t decremented when the validation rejected the attach. The published description across Red Hat, SUSE, Ubuntu (OSV), Debian OSV, NVD, and oth...

CVE-2022-50855

In the Linux kernel, the following vulnerability has been resolved: bpf: prevent leak of lsm program after failed attach In 0, we added the ability to bpfprogattach LSM programs to cgroups, but in our validation to make sure the prog is meant to be attached to BPFLSMCGROUP, we return too early if...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992449)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992449 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992611)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992611 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into...

SUSE CVE-2023-54153

In the Linux kernel, the following vulnerability has been resolved: ext4: turn quotas off if mount failed after enabling quotas Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4markrecoverycomplete returns an error value, the error handling pat...

CVE-2025-68914

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table...

EUVD-2023-60292

In the Linux kernel, the following vulnerability has been resolved: ext4: turn quotas off if mount failed after enabling quotas Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4markrecoverycomplete returns an error value, the error handling pat...