EUVD-2026-49109

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

EUVD-2026-49110

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In doaction's UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases, the memmove destination is Add2Ptre, le16tocpue-view.dataof...

EUVD-2026-49071

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

CVE-2026-64293

A flaw was found in the Linux kernel's iommufd component. This vulnerability arises from an incorrect size calculation during a bound-check in the iommufdveventqfopsread function. On 32-bit systems, this error can lead to an out-of-bounds write, allowing data to be copied past the intended...

CVE-2026-64536

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...

CVE-2026-64532

CVE-2026-64532 affects the Linux kernel ntfs3 code path and fixes an out-of-bounds write in UpdateRecordDataRoot/UpdateRecordDataAllocation. In do_action(), the memmove destination is Add2Ptr(e, le16_to_cpu(e->view.data_off)) where e->view.data_off comes from an on-disk NTFS_DE inside INDEX...

CVE-2026-64533

In the Linux kernel NTFS3 code, the log_replay path that converts DIR_PAGE_ENTRY_32 to DIR_PAGE_ENTRY may read beyond bounds when processing lcns_follow, enabling out-of-bounds access from malformed restart-table metadata. The fix constrains memmove length by computing the maximum valid lcns_foll...

CVE-2026-64531

The CVE-2026-64531 issue affects Open vSwitch flow actions stored as nlattrs in the Linux kernel’s net/openvswitch path. A prior change removed a guard on the action length, enabling a total sw_flow_actions stream to exceed 64 KiB and allowing a nested action container to be truncated via nla_len...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in glXDispChangeDrawableAttributes. A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapp...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in glXDispChangeDrawableAttributes. A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapp...

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

NocoBase - SQL Injection

NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

Microsoft FrontPage Extensions - Information Disclosure

Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /vtibin/ virtual directory. id: CVE-2000-0114 info: name: Microsoft FrontPage Extensions - Information Disclosure author: r3naissance,matejsmycka severity...

reNgine 2.2.0 - Command Injection

reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/wafdetector/?url= string. The commands are executed as root via subprocess.checkoutput. id: CVE-2023-50094 info: name: reNgine 2.2.0 - Command Injection...

Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data,...

Zitadel - User Registration Bypass

The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the...