Security update for systemd

This update for systemd fixes the following issues: CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method bsc1259650. CVE-2026-29111: local unprivileged user can trigger an assert in systemd bsc1259418. udev: check for invalid chars in various fields...

CVE-2026-23368 net: phy: register phy led_triggers during probe to avoid AB-BA deadlock

In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy ledtriggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDSTRIGGERNETDEV and LEDTRIGGERPHY are enabled: 1362.049207 ledtriggerregister+0x5c/0x1fc...

The vulnerability of the cs35l41_volatile_reg() function in the include/sound/cs35l41.h module of the Linux kernel allows a hacker to access protected information or cause a service failure.

The vulnerability of the cs35l41volatilereg function in the include/sound/cs35l41.h module of the Linux kernel is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

The vulnerability of the iio_device_register_eventset() function in the drivers/iio/industrialio-event.c module allows a hacker to cause a service failure for various types of built-in sensors in the Linux operating system.

The vulnerability of the iiodeviceregistereventset function in the drivers/iio/industrialio-event.c module of various types of embedded sensors for Linux operating systems is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the mISDN_dsp_element_register() function in the drivers/isdn/mISDN/dsp_pipeline.c module of the Linux operating system’s ISDN driver framework allows a hacker to cause a service failure.

The vulnerability of the mISDNdspelementregister function in the drivers/isdn/mISDN/dsppipeline.c module of the Linux operating system’s ISDN driver framework is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the max9286_v4l2_register() function in the drivers/media/i2c/max9286.c file of the multimedia device driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the max9286v4l2register function in the drivers/media/i2c/max9286.c file of the multimedia device driver for the Linux operating system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the cpt_register_algs() function in the drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c file of the Linux kernel cryptographic accelerator driver allows a hacker to cause a service failure.

The vulnerability of the cptregisteralgs function in the drivers/crypto/marvell/octeontx2/otx2cptvfalgs.c driver of the Linux kernel cryptographic accelerator is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a system failure...

WordPress login_register plugin <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin loginregister versions = 1.2.0...

ROS-20260323-73-0008

A vulnerability in the uartregisterdriver function of the Linux kernel is related to a pointer dereferencing error. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2019-25606

Fast AVI MPEG Joiner 1.2.0812 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload in the License Name field. Attackers can create a malicious text file containing 6000 bytes of data and paste it into the License Name inpu...

UBUNTU-CVE-2019-25591

DNSS Domain Name Search Software 2.1.8 contains a buffer overflow vulnerability in the registration code input field that allows local attackers to crash the application by submitting an excessively long string. Attackers can trigger a denial of service by pasting a malicious registration code...

CVE-2019-25606

Vulnerability summary: CVE-2019-25606 affects Fast AVI MPEG Joiner 1.2.0812. The issue is a buffer overflow in the License Name input that can be triggered by an oversized payload, enabling a local attacker to cause a denial of service by pasting a ~6000-byte text file into the License Name field...

CVE-2019-25591

DNSS Domain Name Search Software 2.1.8 contains a buffer overflow vulnerability in the registration code input field that allows local attackers to crash the application by submitting an excessively long string. Attackers can trigger a denial of service by pasting a malicious registration code...

CVE-2026-1503

The loginregister plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0. This is due to missing nonce validation on the settings page and insufficient input sanitization and output escaping on the...

CVE-2026-2375

The CVE covers the App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress. Affected: plugin version range up to 5.5.10 on WordPress sites using WCFM Marketplace. Root cause: verify_role() in AuthTrails.php explicitly whitelists the wcfm_vendor role alongside subscriber ...

CVE-2026-2375

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the verifyrole function in AuthTrails.php explicitly whitelisting the wcfmvendor role alongside subscriber and...

PT-2026-26811

The login register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0. This is due to missing nonce validation on the settings page and insufficient input sanitization and output escaping on the 'login regist...

CVE-2026-29056: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint UserInviteController::register accepts all POST parameters and passes them to UserModel::create without filtering out the role field. An attacker who receives an...

Linux Distros Unpatched Vulnerability : CVE-2026-24097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 EOL allows authenticated users to enumerate existing...

UBUNTU-CVE-2026-4105

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus Desktop Bus method. A local unprivileged user can exploit this by attempting to register a machine with a...