CVE-2026-53086 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53086 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53267 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53267 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52927 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52927 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52968 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52968 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52941 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52941 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52919 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52919 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-59725 Socket.IO: Engine.IO Polling Transport Connection Exhaustion

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated...

EUVD-2026-42312

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as proto through an inherited property of the clients object during WebTransport upgrade handling, causing a...

CVE-2026-59876 protobufjs: Text Format string map parsing can mutate returned map object prototype

protobufjs compiles protobuf definitions into JavaScript JS functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of...

WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin LatePoint versions = 5.6.3...

CVE-2026-55668

The CVE affects File Browser’s ScopedFs component prior to version 2.63.16. An authenticated user with Create and Modify permissions can trigger ScopedFs to validate the nearest existing ancestor of a dangling symlink and then follow the symlink during file creation, allowing attacker‑controlled ...

WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by dutafi in WordPress Plugin Events Manager versions = 7.3.6...

MINI-2X2F-XHRX-76MM

Bulletin has no description...

WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin Booking and Rental Manager versions = 2.6.9...

Important: Red Hat Security Advisory: 389-ds-base security update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

RLSA-2026:36317 Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: golang crypto/x509: Denial of...

CVE-2026-14489

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on...

CVE-2026-14500

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied...

kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill

A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance IOAM6 trace fill functionality. An integer overflow vulnerability exists in the ioam6filltracedata function, where the schema length calculation can wrap around due to being stored in an 8-bit unsigned...

EUVD-2026-42174

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on...