CVE Vulnerabilities - 18 October 2026

Vanus 0.8‑0.9 allows remote admin access via default token

CVE-2026-111998

Versions 0.8.0 through 0.9.0 of Vanus come with a built-in administrator token that is the same for every installation. Anyone who knows this token can connect to the system's gateway and act as a clu...

9.3

WordPress Conversational Forms for ChatBot lets attackers run code

CVE-2026-110886

The Conversational Forms for ChatBot plugin for WordPress can be tricked into processing crafted data, allowing an attacker to run unwanted commands on the server. This could lead to unauthorized acce...

9.8

OttoKit plugin lets attackers gain higher privileges

CVE-2026-110372

The OttoKit plugin for WordPress (versions up to 1.1.40) can assign users more rights than intended. An attacker who can interact with the plugin could upgrade their account to an administrator level,...

9.8

Canonical Linux packages updated to prevent potential breach

CVE-2026-53399 DEBIAN-CVE-2026-53399 ROOT-OS-DEBIAN-12-CVE-2026-53399 ROOT-OS-DEBIAN-11-CVE-2026-53399

Several Canonical Linux packages, including the standard, AWS, Azure, LTS Xenial, and AWS HWE versions, had a security weakness that could let attackers gain unauthorized access. The issue has been fi...

8.9

Linux packages could allow unauthorized system changes

DEBIAN-CVE-2026-52914 ROOT-OS-DEBIAN-11-CVE-2026-52914 CVE-2026-52914 BELL-CVE-2026-52914

Several Canonical Linux packages, including standard, AWS, Azure, and LTS versions, had a security weakness that could let attackers modify the system without permission. The issue has been fixed in n...

7.8

Canonical Linux images could let attackers take control

DEBIAN-CVE-2026-53086 ROOT-OS-UBUNTU-2204-CVE-2026-53086 CVE-2026-53086 UBUNTU-CVE-2026-53086

Ubuntu Linux images provided by Canonical for AWS, Azure, LTS Xenial and other platforms are vulnerable and could allow an attacker to gain full system control. Updating to the latest patched package ...

8.4

Linux kernels on Debian 12 and Ubuntu AWS vulnerable

DEBIAN-CVE-2026-64541 CVE-2026-64541 ROOT-OS-DEBIAN-12-CVE-2026-64541 UBUNTU-CVE-2026-64541

The standard Linux kernel packages used by Debian 12 and several Ubuntu AWS images contain a flaw that could let an attacker take control of the system. This puts servers and workstations at risk of u...

9.8

Canonical Linux packages allow attackers to run code

ROOT-OS-DEBIAN-11-CVE-2026-53355 ROOT-OS-DEBIAN-12-CVE-2026-53355 DEBIAN-CVE-2026-53355 BELL-CVE-2026-53355

Several Canonical Linux distributions, including the standard, AWS, Azure, and long‑term support versions, contain a flaw that could let an attacker execute commands on the system. The issue has been ...

9.8

Booktics plugin lets attackers run database commands

CVE-2026-109894

The Booktics plugin for WordPress (versions up to 1.0.29) can be tricked into executing malicious database queries. This could let an attacker view, change, or delete your site’s data. Update to a new...

9.3

Linux packages could be exploited to gain root access

ROOT-OS-DEBIAN-12-CVE-2024-36913 ROOT-OS-UBUNTU-2204-CVE-2024-36913 UBUNTU-CVE-2024-36913 CVE-2024-36913

Several Linux packages provided by Debian and Canonical have been found to contain a flaw that could let an attacker obtain full system control. The issue has been fixed in newer releases of those pac...

9.3

Strong Testimonials plugin <=3.3.12 may execute malicious code

CVE-2026-107436

The Strong Testimonials plugin for WordPress (versions up to 3.3.12) can be fooled into processing crafted data, allowing an attacker to run their own code on your site. This could let a bad actor tak...

8.8

pgbouncer in Red Hat hardened images can grant higher privileges

RHSA-2026:83843

The pgbouncer component included in Red Hat’s hardened container images had a flaw that could let a malicious user gain more rights than intended. This could let attackers move from a limited role to ...

8.8

Linux packages on Debian 12 could be misused

ROOT-OS-DEBIAN-13-CVE-2025-40328 ROOT-OS-DEBIAN-12-CVE-2025-40328 UBUNTU-CVE-2025-40328 CVE-2025-40328

The Linux kernel packages used in Debian 12 and related Ubuntu cloud images had a security weakness that could let an attacker gain unauthorized control. The issue has been corrected in updated packag...

8.8

RootIO Linux for Debian 12 may allow unauthorized access

ROOT-OS-DEBIAN-12-CVE-2025-40342 ROOT-OS-UBUNTU-2404-CVE-2025-40342 ROOT-OS-DEBIAN-13-CVE-2025-40342 ROOT-OS-UBUNTU-2204-CVE-2025-40342

Several Linux packages from Debian and Canonical (including the RootIO Linux package for Debian 12 and cloud‑specific builds) contained a security weakness that could let an attacker gain unauthorized...

8.8

Linux kernel updates stop remote code execution risk

DEBIAN-CVE-2026-64554 CVE-2026-64554 ROOT-OS-DEBIAN-12-CVE-2026-64554 UBUNTU-CVE-2026-64554

Several Linux kernel packages from Canonical, including the HWE Edge and various AWS and Azure builds, have been updated to fix a security hole that could let an attacker run code on your servers. The...

7.9

Linux packages on Debian and Canonical could let attackers run code

BELL-CVE-2026-31432 ROOT-OS-DEBIAN-12-CVE-2026-31432 UBUNTU-CVE-2026-31432 CVE-2026-31432

The Linux kernels provided by Debian 12 and several Canonical cloud images have a weakness that could let an attacker execute unauthorized programs. This could lead to loss of control over the affecte...

9.4

Linux packages on Debian 12 and Ubuntu could allow attacker to gain control

ROOT-OS-UBUNTU-2204-CVE-2026-53075 DEBIAN-CVE-2026-53075 ROOT-OS-UBUNTU-2404-CVE-2026-53075 CVE-2026-53075

The Linux kernel packages for Debian 12 and several Ubuntu releases (including standard, AWS, Azure and LTS versions) contain a flaw that could let a malicious user obtain full system privileges. The ...

6.3

Linux packages need update to prevent unauthorized code execution

ROOT-OS-DEBIAN-12-CVE-2023-53764 UBUNTU-CVE-2023-53764 CVE-2023-53764 ROOT-OS-UBUNTU-2204-CVE-2023-53764

Several Linux distributions, including Debian and Canonical's Ubuntu variants, have a security gap that could let attackers run their own code on your servers. The problem has been fixed in newer rele...

8.8

Linux kernel may let attackers gain system control

CVE-2026-46238 DEBIAN-CVE-2026-46238 ROOT-OS-DEBIAN-12-CVE-2026-46238 ROOT-OS-DEBIAN-11-CVE-2026-46238

Several Linux kernel packages (including HWE, Edge, KVM, Oracle, and FIPS versions) could allow a malicious user to take over the system. This could expose your servers to unauthorized access and data...

8.8

Canonical Linux kernels could allow attacker control

ROOT-OS-DEBIAN-12-CVE-2026-64475 CVE-2026-64475 DEBIAN-CVE-2026-64475 UBUNTU-CVE-2026-64475

Several Canonical Linux kernel packages (including the HWE edge, AWS, and Azure versions) have a security weakness that could let an attacker gain unauthorized access. This could lead to data theft or...

8.8

Linux packages could let attackers gain system control

ROOT-OS-DEBIAN-11-CVE-2026-63829 CVE-2026-63829 ROOT-OS-DEBIAN-12-CVE-2026-63829 DEBIAN-CVE-2026-63829

Several Canonical Linux packages (including the standard, AWS, Azure, LTS Xenial, and HWE versions) had a serious security hole that could allow a malicious user to take full control of the system. Th...

8.8

Linux package could let attackers gain root access

ROOT-OS-DEBIAN-13-CVE-2025-40282 ROOT-OS-DEBIAN-12-CVE-2025-40282 ROOT-OS-UBUNTU-2404-CVE-2025-40282 UBUNTU-CVE-2025-40282

Several Linux packages for Debian 12 and Canonical distributions were found to allow a user to acquire full system control. The issue has been corrected in newer releases of those packages. Install th...

8.8

Linux kernel packages for Ubuntu may allow remote code execution

ROOT-OS-DEBIAN-13-CVE-2026-64390 ROOT-OS-DEBIAN-12-CVE-2026-64390 DEBIAN-CVE-2026-64390 CVE-2026-64390

Several Ubuntu kernel packages, including the standard, AWS, and Azure builds, contain a flaw that could let an attacker run their own code on the server. This could lead to loss of control over the s...

9.4

WordPress Support Genix plugin lets attackers alter database

CVE-2026-110895

The Support Genix plugin for WordPress can be tricked into running unauthorized commands on the website's database, potentially exposing or changing stored information. This risk exists in all version...

8.5

Login with Phone Number plugin lets attackers become admins

CVE-2026-110373

Versions of the WordPress "Login with Phone Number" plugin up to 1.8.77 let a user who logs in with a phone number gain full administrator rights on the site. This could allow them to change settings,...

8.1