CVE-2026-79324: Authorization Bypass Through User-Controlled Key

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

PT-2026-88803

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49310: Undefined Security Weakness

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-81644: Undefined Security Weakness

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

The vulnerability of the adis16550_trigger_handler() function in the drivers/iio/imu/adis16550.c module of the Linux kernel allows a hacker to gain unauthorized access to protected information.

The vulnerability of the adis16550triggerhandler function in the drivers/iio/imu/adis16550.c module of the Linux kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to gain unauthorized access to protected information...

The vulnerability of the ebtables_init() function in the net/bridge/netfilter/ebtables.c module, which is part of the Linux kernel’s networking functions, allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ebtablesinit function in the net/bridge/netfilter/ebtables.c module, which is part of Linux’s kernel-based networking functions, is related to synchronization errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-88794

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

The vulnerability of the net_devmem_bind_dmabuf() function in the net/core/devmem.c module, which is part of the Linux kernel’s networking functions, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the netdevmembinddmabuf function in the net/core/devmem.c module, which is part of Linux’s kernel-based networking functions, relates to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the ovpn_tcp_close() function in the drivers/net/ovpn/tcp.c module of the Linux kernel’s network device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ovpntcpclose function in the drivers/net/ovpn/tcp.c module of the Linux kernel’s network device driver is related to a race condition in the signal processing routine. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the dma_buf_fd() function in the drivers/dma-buf/dma-buf.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dmabuffd function in the drivers/dma-buf/dma-buf.c module of the Linux kernel is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

PT-2026-88801

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-88793

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

The vulnerability of the vgic_its_restore_dte() function in the arch/arm64/kvm/vgic/vgic-its.c module of the ARM virtualization subsystem in the 64-bit Linux operating system allows a attacker to access protected information or cause service failure.

The vulnerability of the vgicitsrestoredte function in the arch/arm64/kvm/vgic/vgic-its.c module of the ARM 64-bit kernel-based Linux operating system involves the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to access...

PT-2026-88995

Name of the Vulnerable Software and Affected Versions VLC media player versions 3.0.0 through 3.0.23 Description A memory-safety issue exists when processing media from an attacker-controlled network source. This flaw involves an out-of-bounds read, which may allow a remote attacker to disclose a...

The vulnerability of the nvme_free_host_mem_multi() function in the driver/nvme/host/pci.c module of the Linux kernel’s NVME driver allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the nvmefreehostmemmulti function in the nvme/host/pci.c driver module of the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the zlib module in CADRA’s Node.js software allows a attacker to cause a service failure.

The vulnerability of the zlib module in CADRA’s Node.js software lies in insufficient validation of input data during the processing of the windowBits parameter. Exploiting this vulnerability could allow an attacker to cause service failures...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rsyslog (UTSA-2026-106764)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106764 advisory. A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cau...

PT-2026-89237

This module enables you to turn a Drupal install into the Central Authentication System CAS Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during...

The vulnerability of the get_ext_report() function in the drivers/virt/coco/sev-guest/sev-guest.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the getextreport function in the drivers/virt/coco/sev-guest/sev-guest.c module of the Linux kernel is related to improper boundary removal of critical data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...