Linux Distros Unpatched Vulnerability : CVE-2026-98626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved,...

PT-2026-118095

Name of the Vulnerable Software and Affected Versions ASUS Armoury Crate affected versions not specified Description An uncontrolled search path element issue allows local users to execute arbitrary code with SYSTEM privileges. This occurs through the replacement of a dynamic-link library DLL,...

FreeRDP RDP Server Replacement

The vulnerability of the freerdphttprequest function in the RDP client FreeRDP is related to errors in the certificate authentication process. Exploiting this vulnerability could allow a malicious actor to replace the RDP server remotely...

pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function

A flaw was found in the pacote component. A remote attacker can exploit this denial of service DoS vulnerability by providing a specially crafted input to the addGitSha function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can le...

CVE-2026-74922

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

CVE-2026-74922 Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

CVE-2026-74922 Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

EUVD-2026-104099

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

CVE-2026-74922

The Document Gallery WordPress plugin, affecting versions 4.1 through 5.1.1 , is vulnerable to an unauthenticated document thumbnail replacement . This issue occurs because the plugin fails to verify signatures on a specific unauthenticated webhook endpoint when no shared secret is configured, wh...

pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function

A flaw was found in the pacote component. A remote attacker can exploit this denial of service DoS vulnerability by providing a specially crafted input to the addGitSha function. This malicious input triggers excessive CPU consumption due to regex replacement and string manipulation, which can le...

CVE-2026-74922: Insufficient Verification of Data Authenticity

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

UBUNTU-CVE-2026-98626

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-98626

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-110024

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

Linux Distros Unpatched Vulnerability : CVE-2026-98709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on...

PT-2026-116928

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211 vif use reserved switch validates a replacement by counting assigned links on ctx-replace ctx and treating reservations too broadly. A link can still b...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Apparmor: Avoid crashing when parsing a profile name that is empty. When processing a packed profile in unpackprofile, the string “:samba-dcerpcd” is parsed as a fully qualified name and then passed to aasplitnfqname...

Astra Linux – Vulnerability in requests

The Requests library is an HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function used a predictable filename when extracting files from zip archives into the system’s temporary directory. If the target file already existed, it was reused without validation....

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390replaceasce, the index of the new ASCE should also be set to 0. Using th...