CVE-2026-81348

CVE-2026-81348 affects the My Private Site WordPress plugin in versions before 4.2.3 . The plugin fails to enforce its site-privacy access control on certain unauthenticated front-end read surfaces—specifically RSS feeds and the sitemap —allowing unauthenticated users to view post content, commen...

EUVD-2026-71852

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

WordPress My Private Site plugin < 4.2.3 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Shivamani Vastrala in WordPress Plugin My Private Site versions 4.2.3...

CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-78150 Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

PT-2026-86336

🚨 CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory...

CVE-2026-53604

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build...

CVE-2026-53604 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build...

CVE-2026-53604 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build...

CVE-2026-53604

nebula-mesh (a self-hosted control plane for Slack Nebula mesh VPN by forgekeep ) is affected by a key-zeroization flaw in its web UI mobile-bundle path. The renderMobileBundle handler passes a decrypted *pki.CAManager containing the CA's ed25519 private key into mobilebundle.Build, which never c...

CVE-2026-80816

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...

CVE-2026-80778 futex/pi: Reject cross-mm private futex owners

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mmusers reference. Nevertheless, attachtopiowner currently accepts an owner from a different address space and copies th...

CVE-2026-80778

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mmusers reference. Nevertheless, attachtopiowner currently accepts an owner from a different address space and copies th...

CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777

CVE-2026-80777 is a race condition in the Linux kernel's futex/pi subsystem. During exec() , there is a window between setting a task's futex exit state to OK and actually swapping its memory map (mm), during which the check comparing a waiter's mm against the owner's mm can return an incorrect r...

EUVD-2026-71420

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80777 futex/pi: Plug private futex exec() race

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

CVE-2026-80776

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futexpivotpending during private hash resize A task performing a custom private hash resize can remain blocked in uninterruptible sleep indefinitely. The hung-task detector reports: INFO: task futex-resizer:314...

CVE-2026-80776 futex: Fix race in futex_pivot_pending() during private hash resize

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futexpivotpending during private hash resize A task performing a custom private hash resize can remain blocked in uninterruptible sleep indefinitely. The hung-task detector reports: INFO: task futex-resizer:314...