Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check the control transfer buffer size before accessing it. If the first fragment is shorter than struct usbcdcnotification, we cannot calculate the expectedsize. Instead, log an error and discard the notification...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain SAUCE patches that include a memory leak issue in the handling of large responses to AppArmor notifications. This bug can be triggered by a non-privileged local user. The memory leak could lead to resource exhaustion...

Astra Linux – Vulnerability in Firefox and Thunderbird

Bypass of the same-origin policy in the DOM: Notification component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 contains SAUCE patches that include a potential NULL pointer dereferencing issue in the handling of AppArmor notifications. This bug can be triggered by an unprivileged local user, and it can lead to a kernel panic...

Astra Linux – Vulnerability in Xen

Inappropriate x86 IOMMU timeout detection/handling: IOMMU processes commands that are issued in parallel with the operation of the CPUs that issue those commands. In the current implementation in Xen, asynchronous notifications of the completion of such commands are not used. Instead, the issuing...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 7.17, and 7.0 contain AppArmor SAUCE patches that, under certain circumstances, may use an uninitialized variable in notification handling code. This bug can be triggered by a non-privileged local user, and it can lead to incorrect caching of AppArmor notification responses...

Astra Linux – Vulnerability in Firefox and Thunderbird

A bug in the calculation of popup notification delays could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467: Improper Neutralization of Argument Delimiters in a Command

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

Exploit for Use After Free in Microsoft

CVE-2026-42978-PoC-Research CVE-2026-4...

CVE-2026-62106

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62106

SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9 ) is affected by a Subscriber-level privilege escalation vulnerability. The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a low-privileged (Subscriber) user can achieve hi...

CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

EUVD-2026-76213

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-89263

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89263 MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89263

MoguBlog through version 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated remote attackers to disable email reply notifications for arbitrary users. The root cause is a missing authentication check in the endpoint handler, which perm...

CVE-2024-12145

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-12145 BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2024-55759

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...