PT-2026-61952

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration...

PT-2026-63290

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The software contains two Server-Side Request Forgery SSRF issues. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location, potentially accessing...

PT-2026-63308

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated low-privilege user can perform a server-side request forgery SSRF during repository migration. The issue occurs because the validation logic in services/migrations/migrate.go...

PT-2026-68327

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description Authenticated attackers can bypass server-side request forgery SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths. The issue occurs because the application...

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea has robust SSRF protection via hostmatcher.NewDialContext for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw http.Get Go's DefaultClient which completely bypasses this protection, enabling SSRF to internal services and...

PT-2026-63288

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains a Server-Side Request Forgery SSRF issue where the repository migration process follows HTTP redirects after the initial URL validation. While Gitea validates the user-supplied...

PT-2026-71735

Name of the Vulnerable Software and Affected Versions TypeORM versions prior to 0.3.31 TypeORM versions prior to 1.1.0 Description TypeORM embeds database schema metadata into JavaScript or TypeScript template literals within the MigrationGenerateCommand.ts file. While backticks are escaped, the...

Important: Red Hat Security Advisory: Red Hat Migration Toolkit for Containers

A new version of Migration Toolkit for Containers MTC is now available. The Migration Toolkit for Containers MTC enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the...

CVE-2026-12898 All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

EUVD-2026-45884

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

CVE-2026-12898: Improper Limitation of a Pathname to a Restricted Directory

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

CVE-2026-63971

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

CVE-2026-64129

CVE-2026-64129 affects the Linux kernel where, in migrate_vma_insert_huge_pmd_page within the memory management code, a spinlock leak could occur if check_stable_address_space() fails after pmd_lock() acquires the PMD spinlock. The path could jump to abort, bypassing the unlock, causing the PMD s...

CVE-2026-63971 sctp: fix race between sctp_wait_for_connect and peeloff

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

CVE-2026-63971

CVE-2026-63971 — Linux kernel SCTP race : The issue occurs when sctp_wait_for_connect drops and re-acquires the socket lock while waiting for an association to reach ESTABLISHED. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), c...

EUVD-2026-45744

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

CVE-2026-63971 sctp: fix race between sctp_wait_for_connect and peeloff

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

CVE-2026-63921

CVE-2026-63921 affects the Linux kernel’s IPv6 VTI (ip6: vti) implementation. The root cause is a collision-lookup using dev_net(dev) in vti6_siocdevprivate(), which, after tunnels migrate between namespaces, can cause SIOCCHGTUNNEL to resolve against the wrong netns. This enables a scenario wher...

CVE-2026-63914

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrmsendmigrate in net/xfrm/xfrmuser.c and pfkeysendmigrate in net/key/afkey.c both hardcode &initnet for the multicast that announces a successful XFRMMSGMIGRATE / SADBXMIGRATE...

CVE-2026-63914

The CVE-2026-63914 issue concerns Linux kernel xfrm/af_key path handling where XFRM_MSG_MIGRATE notifications were unintentionally sent to init_net instead of the caller’s netns due to hardcoded &init_net in xfrm_send_migrate() and pfkey_send_migrate(). The netlink path for migrations was not net...