PT-2026-64353

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur during the removal of a shared GPIO proxy's parent. This issue stems from an excessively wide critical section using a mutex embedded in the gpio shared entry...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-57427

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-57427 WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-57427

CVE-2026-57427 documents an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Download Monitor — WPForms Lock plugin, version

EUVD-2026-48169

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-57427 WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

CVE-2026-64600 xfs: resample the data fork mapping after cycling ILOCK

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfsreflinkfillcowhole,delalloc are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a...

CVE-2026-57427: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

PT-2026-63827

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

RHEL 10 : kernel (RHSA-2026:44694)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:44694 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: sched: actcsum: validat...

RockyLinux 10 : kernel (RLSA-2026:42919)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42919 advisory. kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: Linux kernel: Denial of Service due to memory leak in...

RockyLinux 9 : kernel (RLSA-2026:43307)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:43307 advisory. kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final...

JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

GHSA-H5V5-8746-G7MM JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

Incorrect Authorization

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Incorrect Authorization in the enforcement of plugin manager lock rules via direct API requests to /lab/api/plugins. An attacker can circumvent administrative restrictions on enablin...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

...

RLSA-2026:42550 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in...