Linux Distros Unpatched Vulnerability : CVE-2026-74596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs,fsverity: remove check for fsverity being enabled in setattrprepare The check that fs-verity is available in the kernel is not necessary here. Filesystems...

Linux Distros Unpatched Vulnerability : CVE-2026-74646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTS...

PT-2026-79533

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate post function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has edit others posts capability befor...

PT-2026-79514

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

PT-2026-79681

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt k ioctl enforce, allowing a process to change meta mode on a non-controlling...

PT-2026-79655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the WMM param handler function within the rtl8723bs staging driver. The function copies a fixed-size WMM parameter element from a received information...

PT-2026-79713

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk tx metadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...

Linux Distros Unpatched Vulnerability : CVE-2026-74733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to...

Linux Distros Unpatched Vulnerability : CVE-2026-74701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided...

PT-2026-79723

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink nl reload doit calls devlink netns get, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

PT-2026-79698

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length prestera fw hdr parse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera fw header before decoding the...

PT-2026-79553

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb update global wp settings' function that only verifies the 'edit posts'...

PT-2026-79583

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.3 Description The download element in the Fabrik extension for Joomla lacks a proper Access Control List ACL check. An ACL is a security mechanism that regulates which users or system processes are granted access t...

PT-2026-79584

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik 4.7.2 - The onGetEmail endpoint did not perform any access checks...

PT-2026-79590

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw-ports tb drom parse entry port validates the device-supplied header-index against sw-config.max port number before indexing sw-ports, but the sibling field...

PT-2026-79517

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

PT-2026-79745

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest endpoints filter via secure user endpoints and...

Linux Distros Unpatched Vulnerability : CVE-2026-74603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to...

CVE-2026-48106

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...

EUVD-2026-64193

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...