Linux Distros Unpatched Vulnerability : CVE-2026-64423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast li...

PT-2026-64609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Ownership and group modifications were ignored when mounting with SMB3 POSIX Extensions, unless CIFS MOUNT CIFS ACL or CIFS MOUNT MODE FROM SID were explicitly set. The issue occurs with...

PT-2026-64644

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the IPv4 IGMP implementation during device destruction under RTNL. The function ip mc destroy dev iterates through the multicast list and calls ip ma put...

PT-2026-64613

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where delete-on-close operations can be completed during deferred or durable handle teardown without available request work. In these scenarios, the...

GHSA-4QCJ-M5WP-JMF4 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

CVE-2026-12503 Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

Improper Link Resolution CWE-59 in /usr/bin/larmstarter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group leading to root privilege escalation via a symlink attack on...

CVE-2026-12502

Loytec LINX firmware (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64 suffers CWE-269 due to improper privilege management in /usr/bin/ltsudo. The issue allows a user in the superadmin group to reset any LARM user password (including the larmapp s...

CVE-2026-7007 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

CVE-2026-7007

The CVE-2026-7007 issue affects Zephyr ext2: the on-disk superblock validation did not require non-zero values for s_blocks_per_group and s_inodes_per_group. If either field is zero, get_ngroups() and get_itable_entry() perform divisions using those fields during mount, triggering a divide-by-zer...

CVE-2026-7007

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

CVE-2026-7007 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

OESA-2026-3148 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3147 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

CVE-2026-12688 ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

CVE-2026-12688

The CVE describes a vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.7 where PayPal IPN notifications are not verified before granting paid group membership. This allows unauthenticated attackers to Forge a payment notification and set any user as a paid member of any grou...

EUVD-2026-48489

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

PT-2026-64300

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

PT-2026-64305

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The ext2 file system fails to verify that the on-disk superblock fields s blocks per group and s inodes per group are non-zero during the mount process in the ext2 verify disk superblock...

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor...

CVE-2026-65897

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...