CVE Vulnerabilities - 18 October 2026

Vanus 0.8‑0.9 allows remote admin access via default token

CVE-2026-111998

Versions 0.8.0 through 0.9.0 of Vanus come with a built-in administrator token that is the same for every installation. Anyone who knows this token can connect to the system's gateway and act as a clu...

9.3

WordPress Conversational Forms for ChatBot lets attackers run code

CVE-2026-110886

The Conversational Forms for ChatBot plugin for WordPress can be tricked into processing crafted data, allowing an attacker to run unwanted commands on the server. This could lead to unauthorized acce...

9.8

OttoKit plugin lets attackers gain higher privileges

CVE-2026-110372

The OttoKit plugin for WordPress (versions up to 1.1.40) can assign users more rights than intended. An attacker who can interact with the plugin could upgrade their account to an administrator level,...

9.8

Linux kernels on Debian 12 and Ubuntu AWS vulnerable

DEBIAN-CVE-2026-64541 CVE-2026-64541 ROOT-OS-DEBIAN-12-CVE-2026-64541 UBUNTU-CVE-2026-64541

The standard Linux kernel packages used by Debian 12 and several Ubuntu AWS images contain a flaw that could let an attacker take control of the system. This puts servers and workstations at risk of u...

9.8

Canonical Linux packages allow attackers to run code

ROOT-OS-DEBIAN-11-CVE-2026-53355 ROOT-OS-DEBIAN-12-CVE-2026-53355 DEBIAN-CVE-2026-53355 BELL-CVE-2026-53355

Several Canonical Linux distributions, including the standard, AWS, Azure, and long‑term support versions, contain a flaw that could let an attacker execute commands on the system. The issue has been ...

9.8

Booktics plugin lets attackers run database commands

CVE-2026-109894

The Booktics plugin for WordPress (versions up to 1.0.29) can be tricked into executing malicious database queries. This could let an attacker view, change, or delete your site’s data. Update to a new...

9.3

Linux packages could be exploited to gain root access

ROOT-OS-DEBIAN-12-CVE-2024-36913 ROOT-OS-UBUNTU-2204-CVE-2024-36913 UBUNTU-CVE-2024-36913 CVE-2024-36913

Several Linux packages provided by Debian and Canonical have been found to contain a flaw that could let an attacker obtain full system control. The issue has been fixed in newer releases of those pac...

9.3

Linux kernel packages for Ubuntu may allow remote code execution

ROOT-OS-DEBIAN-13-CVE-2026-64390 ROOT-OS-DEBIAN-12-CVE-2026-64390 DEBIAN-CVE-2026-64390 CVE-2026-64390

Several Ubuntu kernel packages, including the standard, AWS, and Azure builds, contain a flaw that could let an attacker run their own code on the server. This could lead to loss of control over the s...

9.4

Linux packages on Debian and Canonical could let attackers run code

BELL-CVE-2026-31432 ROOT-OS-DEBIAN-12-CVE-2026-31432 UBUNTU-CVE-2026-31432 CVE-2026-31432

The Linux kernels provided by Debian 12 and several Canonical cloud images have a weakness that could let an attacker execute unauthorized programs. This could lead to loss of control over the affecte...

9.4

Linux kernel packages may let attackers gain control

ROOT-OS-DEBIAN-11-CVE-2025-21927 CVE-2025-21927 ROOT-OS-UBUNTU-2204-CVE-2025-21927 ROOT-OS-DEBIAN-12-CVE-2025-21927

Several Linux kernel packages for Debian 12 – including the standard kernel, hardware‑enablement edge, and the AWS and Azure cloud versions – have a security flaw that could allow an attacker to take ...

9.9

Linux packages may allow unauthorized code execution

ROOT-OS-DEBIAN-12-CVE-2023-54125 UBUNTU-CVE-2023-54125 DEBIAN-CVE-2023-54125 BELL-CVE-2023-54125

Several Linux builds, including Debian and Canonical variants, contain a flaw that could let an attacker run code with system privileges. The issue has been fixed in newer releases. Apply the latest u...

9.1

Canonical Linux packages could let attackers run code

DEBIAN-CVE-2026-53130 ROOT-OS-UBUNTU-2404-CVE-2026-53130 ROOT-OS-DEBIAN-11-CVE-2026-53130 ROOT-OS-DEBIAN-12-CVE-2026-53130

Several Canonical Linux distributions, including the standard, AWS, Azure and LTS Xenial versions, contain a flaw that could allow an attacker to execute their own code on the server. This could lead ...

9.1

WhoDB can let attackers read or modify any file

CVE-2026-112005

Versions of WhoDB from 0.104.0 up to but not including 0.135.0 let a remote user run special database commands that can access any file on the server. This could expose secret keys, credentials, or al...

9.2

Linux packages for Azure, AWS, GCP may let attackers gain control

CVE-2026-46043 BELL-CVE-2026-46043 ROOT-OS-DEBIAN-12-CVE-2026-46043 ROOT-OS-DEBIAN-11-CVE-2026-46043

The Linux operating system images provided for Azure, Amazon Web Services, and Google Cloud can be exploited to let an attacker execute code with high privileges. The issue has been fixed in newer pac...

9.9

Linux KVM and related packages could let attackers gain root

DEBIAN-CVE-2026-31637 ROOT-OS-DEBIAN-11-CVE-2026-31637 ROOT-OS-DEBIAN-12-CVE-2026-31637 ROOT-OS-DEBIAN-13-CVE-2026-31637

The Linux kernel packages for Debian 12, including the standard, KVM, Oracle, FIPS and AWS versions, had a flaw that could allow a malicious user to obtain full system control. This could let an attac...

9.4

Linux kernel on Debian 12 may allow unauthorized access

ROOT-OS-DEBIAN-13-CVE-2025-38615 ROOT-OS-DEBIAN-12-CVE-2025-38615 CVE-2025-38615 ROOT-OS-UBUNTU-2404-CVE-2025-38615

The Linux kernel packages used in Debian 12 (including the standard, HWE edge, and AWS 5.0 versions) have a security weakness that could let an attacker gain control of the system. This could lead to ...

9.1