EUVD-2026-46269

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration...

Malicious Package

Overview web3-p7 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the deserialization process. An attacker can cause undefined behavior, crash the process, or potentially disclose memory contents by submitting a specially crafted payload. Remediation Upgrade org.apache.fory:fory-core...

CVE-2026-59885

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One ASN.1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload...

SUSE CVE-2026-63982

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress - ethy:egress - ethx:ingress mirred loop When mirred redirects to ingress from either ingress or egress the loop state from schedmirreddev array dev is lost because of 1 the packet deferral into the...

SUSE CVE-2026-64020

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dmavecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dmavec allocation was getting leaked on the completion...

SUSE CVE-2026-64082

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

SUSE CVE-2026-64107

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512xoverclockxxxput In the pcm512x chipset driver, pcm512xoverclockxxxput is defined as a general mixer kcontrol instead of a DAPM kcontrol, so struct sndsocdapmcontext must n...

CVE-2026-60080

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

CVE-2026-60080 Apache Fory: Rust MetaString heap use-after-free

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

CVE-2026-60080 Apache Fory: Rust MetaString heap use-after-free

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

CVE-2026-64606 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the...

CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

columba v2.0.9

Columba Columba is a simple messaging and voice app for the Reticulum network on Android. Send LXMF messages and make LXST voice calls without relying on the internet, cell towers, or any central servers. Built with a native Android interface and Material Design 3, Columba brings mesh networking ...

CVE-2026-64066

A flaw was found in the Linux kernel's netfs component. The netfsreadtopagecache function does not properly pause the generation of new subrequests when a previously issued subrequest has failed. This oversight can lead to continued resource consumption or incorrect system state, potentially...

PT-2026-62968

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-62830

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Order Management versions 12.2.3 through 12.2.15 Description A flaw exists in the Product Diagnostic Tools component of Oracle Order Management. A high privileged attacker with network access via HTTP can exploit...

PT-2026-62725

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Asset Management versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation requires...

PT-2026-63011

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Configure to Order versions 12.2.3 through 12.2.15 Description A flaw in the Supply to Order Workbench component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lea...