CVE-2026-78146

The Simple Newsletter Plugin (Noptin) for WordPress versions before 4.3.3 fails to verify that a requester is the subscriber referenced in a public request before rendering that subscriber's stored details via the Actions page . This allows unauthenticated users to disclose a subscriber's persona...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

EUVD-2026-66253

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

CVE-2026-19760

The WP Fastest Cache WordPress plugin (all versions up to and including 1.5.0) is vulnerable to unauthenticated stored cross-site scripting via the HTTP Host header. Insufficient input sanitization and output escaping in the Host-header-to-URL code path allows an attacker to inject arbitrary scri...

CVE-2026-19760 WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

SUSE CVE-2026-72499

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

PT-2026-82372

Name of the Vulnerable Software and Affected Versions Drupal Monster Menus versions 0.0.0 through 9.5.3 Description Stored Cross-site Scripting XSS occurs because the module does not sufficiently sanitize HTML code within the page name when it is displayed in the built-in tree browser. This allow...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

VulnCheck KEV: CVE-2026-43494

In the Linux kernel, the following vulnerability has been resolved: net/rds: reset opnents when zerocopy page pin fails When iovitergetpages2 fails in rdsmessagezcopyfromuser, the pinned pages are released with putpage, and rm-data.opmmpznotifier is cleared. But we fail to properly clear...

Linux Distros Unpatched Vulnerability : CVE-2026-78999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098810)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098810 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CTPTPNUM from 1 to 4 to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098743)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098743 advisory. In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSENOTIFYRETRIEVE to uptodate folios FUSENOTIFYRETRIEVE must be limited to uptodate...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098911)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098911 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098893)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098893 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes WARNING With extra warning o...

Linux Distros Unpatched Vulnerability : CVE-2026-80523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical ...

Linux Distros Unpatched Vulnerability : CVE-2026-79275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-79075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information...

Linux Distros Unpatched Vulnerability : CVE-2026-79105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a craft...

VulnCheck KEV: CVE-2026-46331

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcfpeditact computes the COW range for skbensurewritable once before the key loop using tcfpoffmaxhint, but the hint does not account for the runtime header offset...