EUVD-2026-48817

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

EUVD-2026-48882

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get1284register fails, the error path drops the driver...

PT-2026-64559

In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720 probe registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get 1284 register fails, the error path drops the driv...

CVE-2026-17059 Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-11354 Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...

EUVD-2026-47926

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are...

GO-2026-6033 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev...

GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea...

EUVD-2026-46270

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the ninja-forms/submissions-table Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated...

CVE-2026-64058

A flaw was found in the Linux kernel's network file system netfs component. The netfsreadfolio function fails to wait for ongoing writeback operations to complete. This can lead to the system incorrectly trusting the dirty flag and prematurely cleaning up private data associated with a folio,...

Linux Distros Unpatched Vulnerability : CVE-2026-64058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix netfsreadfolio to wait on writeback Fix netfsreadfolio to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever ...

CVE-2026-64058 netfs: Fix netfs_read_folio() to wait on writeback

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadfolio to wait on writeback Fix netfsreadfolio to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio-private folio-private may get cleaned up by the...

CVE-2026-63990 bonding: refuse to enslave CAN devices

In the Linux kernel, the following vulnerability has been resolved: bonding: refuse to enslave CAN devices syzbot reported a kernel paging request crash in canrxunregister inside net/can/afcan.c. The crash occurs because a virtual CAN device vxcan is being enslaved to a bonding master. During the...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

CVE-2026-56171

Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network...

EUVD-2026-41635

Gitea has insufficient permission checks for Composer package source links...

CVE-2026-43977 wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exis...

Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network...

CVE-2026-50657

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally...

Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally...