CVE-2026-90242: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

PT-2026-94502

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the ksmbd all conn set status function incorrectly treats every connection with a set transient binding flag as belonging to the target SessionI...

CVE-2026-81869

OpenTelemetry-Go versions 1.10.0 through 1.33.0 contain a flaw in the sdk/trace/span.go attribute truncation path. When a string or string-slice attribute contains the valid Unicode replacement character U+FFFD , the safeTruncateValidUTF8 function misidentifies it as invalid UTF-8 and returns the...

CVE-2026-81869 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

CVE-2026-92763 Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths tha...

CVE-2026-92763 Rundeck through 6.2.1 Authorization Bypass via Project Import

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths tha...

CVE-2026-92763

Rundeck through 6.2.1 contains an authorization bypass in the project archive import endpoint. The importConfig and importNodesSources parameters are not properly authorized, allowing an attacker with only the import action to replace project configuration files, including security-relevant setti...

EUVD-2026-81031

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths tha...

CVE-2026-82561

Apache NiFi versions 1.5.0 through 2.11.0 contain a missing authorization flaw in REST API methods used for Process Group flow replacement and versioned flow update/rebase operations. These methods only checked read/write permissions on the Process Group itself, unlike their asynchronous counterp...

EUVD-2026-81077

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

SUSE CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

CVE-2026-77702

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

[SECURITY] Fedora 43 Update: python-configargparse-1.7.7-1.fc43

A drop-in replacement for argparse that allows options to also be set via config files and/or environment variables. Applications with more than a handful of user-settable options are best configured through a combination of command line args, config files, hard-cod ed defaults, and in some cases...

[SECURITY] Fedora 45 Update: python-configargparse-1.7.7-1.fc45

A drop-in replacement for argparse that allows options to also be set via config files and/or environment variables. Applications with more than a handful of user-settable options are best configured through a combination of command line args, config files, hard-cod ed defaults, and in some cases...

CVE-2026-44300

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

EUVD-2026-78920

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830

Shopper (Headless e-commerce Admin Panel) is affected by a missing authorization check in the Media sub-form (packages/admin/src/Livewire/Components/Products/Form/Media.php). The store() method lacked the authorize('edit_products') call that was added to five sibling sub-forms (Edit, Inventory, S...