PT-2026-68130

Name of the Vulnerable Software and Affected Versions libkcapi affected versions not specified Description Memory corruption occurs in the one-shot AIO Asynchronous I/O path of libkcapi. The issue arises when the path returns an error before all submitted IOCBs I/O Control Blocks are drained, whi...

PT-2026-68131

Name of the Vulnerable Software and Affected Versions libkcapi affected versions not specified Description A flaw exists in the Asynchronous Input/Output AIO interface. A local attacker can cause an application or thread to become unresponsive by reusing an AIO-enabled handle after a completion...

CVE-2026-71227: Loop with Unreachable Exit Condition

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-71226: Use After Free

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

WordPress Meta Box AIO plugin <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Austin Ginder in WordPress Plugin Meta Box AIO versions = 3.8.0...

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488

CVE-2026-14488 affects the Meta Box AIO WordPress plugin (MB Frontend Submission extension) up to version 3.8.0. The vulnerability stems from handle_request() routing the mbfs_delete action without capability/ownership checks, and nonce verification in check_ajax() being gated behind is_ajax(), w...

CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

CVE-2026-14488: Missing Authorization

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

PT-2026-65769

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle request function routing the mbfs delete action without any capability or...

CVE-2026-64331

A flaw was found in the Linux kernel's usbip virtual USB device controller vudc. This vulnerability, a NULL pointer dereference, occurs when vepallocrequest fails to initialize a vrequest's udc field, causing asynchronous input/output AIO cancellations on the FunctionFS path to arrive without a...

CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

UBUNTU-CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

CVE-2026-64331

CVE-2026-64331 is a NULL pointer dereference in the Linux kernel's usbip vudc subsystem. The root cause is that vep_alloc_request() never initialized vrequest-&gt;udc, so when FunctionFS AIO cancellations arrived in vep_dequeue, a NULL UDC reference caused a kernel oops. The bug reportedly existe...

CVE-2026-64331: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...

Linux Distros Unpatched Vulnerability : CVE-2026-64331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in...

Malicious Package

Overview aio-commerce-lib-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...