CVE-2026-80930 tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...

CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

CVE-2026-89253

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) has a stored cross-site scripting (XSS) vulnerability in the user donationLink profile field. The value is validated only with filter_var(..., FILTER_VALIDATE_URL), which accepts injected payloads, and is output via strip_tags(...

CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

CVE-2026-19991

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-11496

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

CVE-2026-19991

CVE-2026-19991 affects the UsersWP WordPress plugin in versions up to and including 1.2.70 , allowing authenticated attackers with Subscriber-level access or higher to perform arbitrary file deletion via the upload_file_remove() AJAX handler. The root cause lies in a validation bypass: the plugin...

EUVD-2026-75939

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

EUVD-2026-75929

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

PT-2026-90080

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Renesas I3C driver employs an asynchronous model for data transfer by preparing a renesas i3c xfer structure, enqueuing it, and waiting for completion. A race condition occurs when a...

PT-2026-96384

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727 release irq lp8727 isr func, the threaded IRQ handler, is the only caller that arms pchg-work via schedule delayed work. lp8727 release irq currently cancels the work before...

CVE-2026-89469: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

PT-2026-90185

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the lp8727 release irq function. The threaded IRQ handler lp8727 isr func arms pchg-work using schedule delayed work. Because lp8727 release irq cancels...

PT-2026-90211

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the o2dlm receive handlers trust length and count fields from the wire without proper bounding. This allows a malicious or compromised node that has joined the DLM...

PT-2026-96429

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr rdy work, max charging time work and batt presence work. pwr rdy work and batt presence work can also queue max charging time work...

CVE-2026-90453: URL Redirection to Untrusted Site

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

PT-2026-90320

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Unprivileged users can trigger a flood of calls to the QueryVariableInfo runtime service by calling the statfs function on the efivarfs mount point. On x86 systems where the variable sto...