EUVD-2026-45885

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

Exploit for CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC...

CVE-2026-63906

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430probe In omap2430probe, ofnodeputnp is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the ofnodepu...

PT-2026-61716

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

PT-2026-61672

Name of the Vulnerable Software and Affected Versions DNG SDK versions 1.7.1 2536 and earlier Description A Stack-based Buffer Overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. This issue...

PT-2026-61571

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1972)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1972 advisory. containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are...

Linux Distros Unpatched Vulnerability : CVE-2026-53994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the attacker-supplied 32-bit...

Linux Distros Unpatched Vulnerability : CVE-2026-42566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed...

PT-2026-61665

Name of the Vulnerable Software and Affected Versions RT versions 6.0.0 through 6.0.2 Description An authenticated user with specific permissions can inject JavaScript into user-controlled data that is rendered without proper HTML escaping. This leads to a stored Cross-Site Scripting XSS issue,...

Important: runfinch-finch

Issue Overview: containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted ima...

Important: runfinch-finch

Issue Overview: containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted ima...

Linux Distros Unpatched Vulnerability : CVE-2026-64119

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU...

Linux Distros Unpatched Vulnerability : CVE-2026-63981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact...

PT-2026-61579

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

PT-2026-61664

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.40 Description A stored cross-site scripting issue exists in the user registration form. This allows an unauthenticated attacker to execute arbitrary JavaScript within the browser session of an administrator,...

Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2026-136 (ALASDOCKER-2026-136)

The version of runfinch-finch installed on the remote host is prior to 1.17.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-136 advisory. containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launch...

Linux Distros Unpatched Vulnerability : CVE-2026-63844

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0.3 ring JPEG rings do not support 64-bit user...

CVE-2026-42566

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.longname that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be...

CVE-2026-42566

The CVE affects Meshtastic firmware prior to 2.7.23.b246bcd where a single node advertising a User.long_name containing malformed UTF-8 over LoRa can render other radios unusable over BLE when managed via the iOS app. Root cause: a null terminator can be placed in the middle of a multibyte sequen...