Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005540)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005540 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix null-ptr-deref when journal load failed. During the mounting process, if journalreset...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005416)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005416 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005461)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005461 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled,...

Server-side Request Forgery (SSRF)

Overview idno/known is an A social publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Session::tryAuthUser authentication flag handling and UnfurledUrl::unfurl resolution in Idno/Core/Session.php and Idno/Entities/UnfurledUrl.php. An...

Exploit for SQL Injection in Salephpscripts Web_Directory_Free

SECTF2026 — "You Play the CTF. We Play Defense" Event: XP...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005431 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfsroot in dirtying inodes via iput During unmount process of...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005536)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005536 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of buffer delay flag Syzbot reported that after...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005570)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005570 advisory. In the Linux kernel, the following vulnerability has been resolved: mailbox: bcm2835: Fix timeout during suspend mode During noirq suspend phase the Raspberry Pi pow...

CVE-2026-28560 wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using jsonencode without the JSONHEXTAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break o...

WordPress plugin wpForo Forum 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The wpFo...

CVE-2026-28400 Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint

Docker Model Runner DMR is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server llama.cpp...

EUVD-2026-9073

Docker Model Runner DMR is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server llama.cpp...

CVE-2026-28400

Affected software/versions: Docker Model Runner (DMR) prior to 1.0.16. Vulnerability: POST /engines/_configure accepts arbitrary runtime flags without authentication, forwarded to the inference server (llama.cpp). Impact: via injecting --log-file, an attacker with network access can write/overwri...

CVE-2025-67601

A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting cacerts...

EUVD-2026-8797

WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via manipulation of backup manifest files. An attacker can execute arbitrary commands in the production deployment environment by restoring a crafted backup. Workaround This vulnerability can be mitigated by specifying...

CVE-2026-27899

WireGuard Portal or wg-portal is a web-based configuration portal for WireGuard server management. Prior to version 2.1.3, any authenticated non-admin user can become a full administrator by sending a single PUT request to their own user profile endpoint with "IsAdmin": true in the JSON body. Aft...

CVE-2026-27942

CVE-2026-27942 affects fast-xml-parser. Before 5.3.8, XMLBuilder with preserveOrder: true can crash with a stack overflow. The issue is fixed in 5.3.8. Workarounds include building XML with preserveOrder: false or validating input data before passing to the builder. Connected sources also referen...

CVE-2026-27899 WireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update

WireGuard Portal or wg-portal is a web-based configuration portal for WireGuard server management. Prior to version 2.1.3, any authenticated non-admin user can become a full administrator by sending a single PUT request to their own user profile endpoint with "IsAdmin": true in the JSON body. Aft...

CVE-2026-27946

ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7...