CVE Vulnerabilities - 9 October 2026

Ubuntu 22.04 Linux could allow unauthorized access

ROOT-OS-UBUNTU-2204-CVE-2025-1369 CVE-2025-1369

A security weakness was found in several Linux packages used on Ubuntu 22.04, which could let an attacker gain unauthorized access to the system. The issue has been fixed in newer package versions. In...

2.0

MongoDB Ops Manager can expose other project host data

CVE-2026-87108

A user who can only view projects in Ops Manager can still pull daily host monitoring information from a different project if they know the record ID. This may reveal details about servers and configu...

2.3

Dell Secure Connect Gateway Policy Manager allows remote tampering

CVE-2026-78017

Versions of Dell Secure Connect Gateway Policy Manager before 5.34.00.16 do not properly handle unexpected conditions. This lets an attacker who already has high-level remote access change data or byp...

3.8

Linux package on Ubuntu 22.04 can run attacker code

CVE-2025-59692 ROOT-OS-UBUNTU-2204-CVE-2025-59692

The Linux package used in Ubuntu 22.04 could let an attacker execute malicious code on the system. This could lead to loss of data or control of the server. Update the package to the latest version pr...

3.7

Linux package needs update to stop known security risk

CVE-2025-59691 ROOT-OS-UBUNTU-2204-CVE-2025-59691

Older Linux packages on Ubuntu 22.04 could allow an attacker to take control of the system. The issue has been fixed in newer releases. Apply the latest Linux package update as soon as possible to pro...

3.7

Dell Secure Connect Gateway Policy Manager allows remote data tampering

CVE-2026-78015

Versions of Dell Secure Connect Gateway Policy Manager before 5.34.00.16 can be tricked by anyone on the network into accepting false information. This could let an attacker change or corrupt data the...

3.7

Affinity app may expose data or crash on crafted file

CVE-2026-101130

The Affinity application for Windows, macOS, iOS, and Android can read past the end of a memory area when it opens specially crafted document files. This could let an attacker see nearby memory conten...

3.6

Affinity by Canva can leak data or crash on files

CVE-2026-101094

The Affinity app from Canva (versions before the October 2026 release) may read beyond its intended memory when it encounters certain malformed text characters in a document. An attacker could create ...

3.6

Canva Affinity for Mac may reveal hidden data in thumbnails

CVE-2026-96395

Older versions of the Canva Affinity app for macOS create thumbnail and preview images for Affinity documents without fully checking the data they read. A crafted document could cause the app to expos...

3.6

Affinity app can crash when opening malicious document

CVE-2026-96393

The Affinity app for Canva (versions before 3.3.1) may stop working if it opens a specially crafted Affinity document. This happens because the app fails to check the size of data inside the file, cau...

3.6

Contao backend actions can run without CSRF protection

CVE-2026-107848 GHSA-9ff2-p842-45wq

The Contao content management system lets certain admin functions be triggered just by visiting a crafted link, without requiring the usual safety token. An attacker could cause unwanted changes for a...

3.5

PHP mysqlnd parser may read beyond packet data

CLEANSTART-2026-UY82629

The mysqlnd component in the PHP package can read data from a server packet before confirming the packet is large enough. This can cause the application to crash or be manipulated by an attacker. Upgr...

3.4

Code Snippets plugin lets subsite admin control network snippets

CVE-2026-106095

The Code Snippets add‑on for WordPress (versions before 3.10.0) lets a user who only manages one site on a multisite installation turn on, turn off, or change the order of code that runs on every site...

3.3

CUPS printing service can crash and stop queues

CVE-2026-107890 DEBIAN-CVE-2026-107890 GHSA-wjc4-qhjr-5m5x UBUNTU-CVE-2026-107890

The CUPS printing system (used in many Linux distributions) can stop working if it receives a specially crafted print request. This causes the service to crash, halting all print jobs and requiring a ...

3.3

CUPS print service can run out of job slots

CVE-2026-107885 DEBIAN-CVE-2026-107885 GHSA-hhw5-qqmc-p6rg UBUNTU-CVE-2026-107885

The printing system used on Debian, Ubuntu and BellSoft Linux servers may stop accepting new print jobs if a client leaves an incomplete print request open. This can fill the queue and cause legitimat...

3.3

Victoria Metrics and Node Problem Detector risk buffer overflow

CLEANSTART-2026-SV16183

The Victoria Metrics and Node Problem Detector components can write more data than expected into a memory area, which may cause the program to crash or be taken over by an attacker. This happens becau...

3.3

CGA-xwmg-c8p5-g2c3

CGA-xwmg-c8p5-g2c3

3.1

CGA-vmqg-wprq-p764

CGA-vmqg-wprq-p764

3.1

CGA-4hcv-m729-3xmv

CGA-4hcv-m729-3xmv

3.1

Affinity for macOS can expose data or crash on preview

CVE-2026-96394

Versions of Affinity for macOS released before 3.3.1 do not correctly check the size of images when they create thumbnail previews in Finder. A specially crafted Affinity file could cause the preview ...

2.9

Vikunja lets users delete linked tasks in other projects

GHSA-w2ch-4xgr-22ww

When a user with edit rights on a task deletes a link, the system does not verify that they can see the linked task in another project. This lets them remove the connection, causing the other project'...

2.3

CUPS printer class handling can crash service

CVE-2026-107886 DEBIAN-CVE-2026-107886 GHSA-pwg4-pv39-8c22 UBUNTU-CVE-2026-107886

The CUPS printing system (versions before 2.4.20) may crash when a user with permission to change printer groups tries to edit or delete those groups. This can stop the printing service for all users....

2.3