CVE-2026-89538 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the allocated receive-page capacity. It then calls xdrbuftrim with a trim...

CVE-2026-89538

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the allocated receive-page capacity. It then calls xdrbuftrim with a trim...

CVE-2026-89538

CVE-2026-89538 affects the Linux kernel's SUNRPC component, specifically the gss_krb5_unwrap_v2() function. A remote peer holding a valid GSS context can send a Kerberos v2 wrap token whose 16-bit "extra count" (ec) field exceeds the plaintext length—a structurally malformed token per RFC 4121 . ...

CVE-2026-89495

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...

EUVD-2026-76399

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

EUVD-2026-76356

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89450 iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

Exploit for CVE-2026-15667

CVE-2026-15667 CVE-2026-15667 WordPress Event Solution LFI POC...

CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

EUVD-2026-76065

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

CVE-2026-85116

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (versions 1.2.2 before 1.42.3) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that the plugin's shortcode parser runs over the entire rendered Contact Form 7 form, including values a visitor submitte...

CVE-2026-85116 Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1 , the escapeLogField() function fails to escape the double quote character, which delimits quoted fields in the Apache combined log format. An unauthenticated remote attacker who controls a value written to a quote...

PT-2026-90254

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss krb5 unwrap v2 function fails to properly validate the 16-bit extra count ec field in Kerberos v2 token headers. A peer with a valid...

Linux Distros Unpatched Vulnerability : CVE-2026-87859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, whic...

PT-2026-89856

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filter var..., FILTER VALIDATE URL, which...

PT-2026-90299

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the eir get service data function within the Bluetooth component. The issue occurs when the function iterates through advertising data to find a Service...

PT-2026-89814

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.1 Description The escapeLogField function fails to escape the double quote character used to delimit quoted fields in the Apache combined log format. An unauthenticated remote attacker can exploit this by injectin...

form-data: form-data: Form field override via CRLF injection

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...