Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130103)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130103 advisory. Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat...

CVE-2026-88101

Weak authentication in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges locally...

CVE-2026-88101

A weak authentication vulnerability in the Microsoft Input Method Editor (IME) allows an authorized attacker to perform a local elevation of privilege . The vulnerability is associated with CWE-1390 . While the base severity is rated as HIGH (7.8), the documents do not provide specific details re...

CVE-2026-109966

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-109966

The yt-dlp-web-ui software, through version 4.0.0 , is vulnerable to an argument injection vulnerability within the Service.Formats JSON-RPC method. Unauthenticated remote attackers can exploit this by supplying a dash-prefixed url parameter via the /rpc/http or /rpc/ws endpoints. By injecting op...

Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability

Weak authentication in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges locally...

CVE-2026-88101: Weak Authentication

Weak authentication in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88101: Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability

Weak authentication in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges locally...

CVE-2026-109334

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...

CVE-2026-109342 SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with...

CVE-2026-109342

SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to a missing authentication flaw in the revoke RPC method . This allows low-privileged or unauthenticated callers to permanently revoke other users' refresh tokens without proof of possession. Attackers can acquire necessary grant identifiers u...

EUVD-2026-97636

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...

CVE-2026-103529

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install method which will then be executed upon installation, enabling remote...

CVE-2026-103529 CVE-2026-103529

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install method which will then be executed upon installation, enabling remote...

EUVD-2026-97481

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install method which will then be executed upon installation, enabling remote...

USN-8913-1 libx11 vulnerabilities

Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard map replies. If a user were tricked into connecting to a malicious X server, a remote attacker could possibly use this issue to cause libx11 to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-8913-1: libx11 vulnerabilities

Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard map replies. If a user were tricked into connecting to a malicious X server, a remote attacker could possibly use this issue to cause libx11 to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2026-109342: Missing Authentication for Critical Function

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with...

PT-2026-110615

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description Authenticated administrators can upload and install modules using the ZIP upload function. The system fails to validate or sandbox embedded PHP code, allowing an attacker to include malicious code within a...