CVE-2026-89651 ceph: bound MDSCapAuth path and fs_name decode in handle_session()

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...

CVE-2026-89635 ksmbd: only rebind the reopened file's own oplock on durable reconnect

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...

CVE-2026-89635

CVE-2026-89635 is a use-after-free vulnerability in ksmbd , the Linux kernel's SMB server component. In ksmbd_reopen_durable_fd(), when a session reconnects with a durable-v2 handle, the code incorrectly rebinds all detached oplocks on the same inode to the reconnecting session, not just the one ...

CVE-2026-89569

CVE-2026-89569 is a use-after-free vulnerability in the Linux kernel's Bluetooth RFCOMM subsystem. The function rfcomm_security_cfm() walks a session's DLC list without holding rfcomm_mutex, while krfcommd can concurrently tear down the same session and DLCs via rfcomm_session_del() and rfcomm_dl...

CVE-2026-89569 Bluetooth: RFCOMM: serialize security confirmation handling

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

EUVD-2026-76480

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-81911

Concrete CMS versions 9.0.0 through 9.5.2 contain a Stored XSS in the Board Custom Slot dialog. The custom_slot save_template endpoint authorizes requests only against the target board instance via canEditBoardContents() but persists the client-supplied selectedTemplateOption[collection] verbatim...

CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

EUVD-2026-76447

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

Security Bulletin: IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

Summary IBM i Access Client Solutions ACS is vulnerable to multiple vulnerabilities CVE-2026-14275, CVE-2026-14276, CVE-2026-14277 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-14276 DESCRIPTION: IBM i Access Client Solutions could allow an authenticated...

EUVD-2026-76108

An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...

CVE-2026-89255 AVideo LoginControl Stored XSS via PGP Public Key

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-89255

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The root cause is a failure to HTML-encode PGP public keys before echoing them into a element. An authenticated attacker can submit a crafted public ...

Exploit for CVE-2026-88861

SecDim Challenge Builder Repro — Assurance Drift Working rep...

CVE-2026-14563

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

EUVD-2026-75961

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

CVE-2025-15695

The Translate WordPress with GTranslate plugin (versions before 3.0.10 ) contains a Stored XSS vulnerability. The root cause is a failure to validate specific settings before bundled front-end scripts generate markup. This allows users with high-level privileges, such as administrators , to injec...

BIT-TOMCAT-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

EUVD-2026-75888

Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully...