2117 matches found
PT-2026-69763
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc6 Description A slab-use-after-free issue exists in the ath9k hif request firmware function. The function re-arms an asynchronous firmware load using request firmware nowait, passing hif dev as the completi...
CVE-2025-71410
Unnumbered Disconnect U DISC and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio...
EUVD-2025-210653
Unnumbered Disconnect U DISC and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio...
CVE-2025-71410
The CVE-2025-71410 issue affects systems handling Aviation Very High Frequency Link Control (VHF L-C) and Unnumbered Disconnect (U DISC) frames used by CPDLC. Described vulnerability can terminate sessions and cause loss of CPDLC functions, forcing a reversion to voice comms and increasing contro...
CVE-2025-71410 Malicious Link Control Frames Can Cause Loss of CPDLC Functions
Unnumbered Disconnect U DISC and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio...
CVE-2025-71411 In CPDLC, Broadcast Control Frames Can Disconnect Multiple Aircraft Simultaneously
Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency...
EUVD-2025-210652
Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency...
The vulnerabilities of the functions ksmbd_tree_conn_connect(), ksmbd_tree_connect PUT(), and ksmbd_tree_conn_disconnect() in the module fs/smb/server/mgmt/tree_connect.c, as well as the function smb2_tree_disconnect() in the module fs/smb/server/smb2pdu.c, allow attackers to compromise the confidentiality, integrity, and accessibility of protected information within the SMB server framework of the Linux operating system.
The vulnerabilities of the functions ksmbdtreeconnconnect, ksmbdtreeconnect PUT, and ksmbdtreeconndisconnect in the module fs/smb/server/mgmt/treeconnect.c, as well as the function smb2treedisconnect in the module fs/smb/server/smb2pdu.c, are related to the reuse of previously freed memory due to...
PT-2026-68418
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the esd usb disconnect function. The function frees each CAN netdev using free candev within a loop and subsequently calls unlink all urbsdev. Because th...
CVE-2026-64585
In the Linux kernel, the following vulnerability has been resolved: can: esdusb: kill anchored URBs before freeing netdevs esdusbdisconnect frees each CAN netdev with freecandev inside its per-netdev loop and only calls unlinkallurbsdev afterwards. The per-netdev private data struct esdusbnetpriv...
CVE-2026-7456
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...
CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...
CVE-2026-7456 Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdisconnect function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...
CVE-2026-7456
The Udimi Tools plugin for WordPress (versions
PT-2026-68033
Name of the Vulnerable Software and Affected Versions WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2 Description Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the wpf stripe callback success and wpf stripe disconnect...
CVE-2026-11368 Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer
The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...
CVE-2026-11368 Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer
The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...
EUVD-2026-52700
The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...
CVE-2026-11368 Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer
The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...
CVE-2026-63252
In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially...