CVE-2026-6396

The Fast & Fancy Filter – 3F plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce verification in the saveFields function, which handles the fffsavesettins AJAX action. This makes it possible for unauthenticated...

CVE-2026-6396

CVE-2026-6396 concerns the WordPress plugin “Fast & Fancy Filter – 3F” (versions up to and including 1.2.2). The issue arises from missing nonce verification in the saveFields() function, which handles the fff_save_settins AJAX action. This design flaw allows unauthenticated attackers to forge re...

CVE-2026-5479

In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSLEVPCipherFinal and related EVP cipher finalization functions fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption,...

CVE-2026-33626

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery SSRF vulnerability in LMDeploy's vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating...

CVE-2026-41135

free5GC UDR is the Policy Control Function PCF for free5GC, an an open-source project for 5th generation 5G mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory...

OSV-2026-608 Stack-buffer-overflow in is_http

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504809218 Crash type: Stack-buffer-overflow READ Crash state: ishttp stungetmessagelenstr FuzzStunClient.c...

Linux kernel virtio_net receive_mergeable buffer overflow DoS

The vulnerability of the receivemergeable function in the drivers/net/virtionet.c file of the Linux kernel’s network device driver is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

Red Database CCH_RELEASE Buffer Overflow DoS

The vulnerability of the CCHRELEASE function in the cch.cpp module of the “Red Database” database management system is related to a violation of expected behavior. Exploiting this vulnerability may allow an attacker, operating remotely, to cause service failure...

Windows Ancillary Function Driver WinSock Privilege Escalation

The vulnerability of the Windows Ancillary Function Driver for WinSock operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2026-34347

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dmaengine idxd component where an invalid memory access can occur. This happens if a first Function Level Reset FLR completes successfully, but a subsequent second...

uutils coreutils security vulnerabilities

uutils coreutils is a cross-platform core command-line tool set developed by Uutils. There is a security vulnerability in uutils coreutils. This vulnerability stems from the mkfifo function, which allows unauthorized modification of existing file permissions. When mkfifo fails to create a FIFO du...

uutils coreutils security vulnerabilities

uutils coreutils is a cross-platform core command-line toolset developed by Uutils Open Source. uutils coreutils has a security vulnerability, which stems from a logical error in the ln function. This vulnerability could allow local attackers to manipulate existing symbolic links, redirecting fil...

uutils coreutils security vulnerabilities

uutils coreutils is a cross-platform core command-line tool set developed by Uutils Open Source. uutils coreutils has a security vulnerability, which stems from a logical error in the ln function. This error may cause failures when processing filenames that are not in UTF-8 encoding, resulting in...

uutils coreutils security vulnerabilities

uutils coreutils is a cross-platform core command-line toolset developed by Uutils Open Source. There is a security vulnerability in uutils coreutils, which stems from a logical error in the tr function. This error incorrectly defines graphic character classes and printable character classes,...

SUSE SLES12 Security Update : ncurses (SUSE-SU-2026:1499-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:1499-1 advisory. This update for ncurses fixes the following issue: - CVE-2025-69720: buffer overflow in function analyzestringof progs/infocmp.c bsc1259924. Tenable ha...

PT-2026-45092

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service issue exists within the Shared NF-profile Parser component, specifically affecting the lib/sbi/nnrf-handler.c library. Manipulation of this component allows a remote attack...

uutils coreutils: Input validation error vulnerability

uutils coreutils is a cross-platform core command-line tool set developed by Uutils Open Source. uutils coreutils has a vulnerability related to input validation. This vulnerability stems from an error in the env function; when the -S option is used, the command-line parameters are not properly...

WordPress plugin Fast & Fancy Filter – 3F Cross-site Request Forgery Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-34524

Name of the Vulnerable Software and Affected Versions DDEV versions prior to 1.25.2 Description DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation with...

CVE-2026-31443: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix crash when the event log is disabled If reporting errors to the event log is not supported by the hardware, and an error that causes Function Level Reset FLR is received, the driver will try to restore the...