Astra Linux – Vulnerability in Firefox and Thunderbird

Bypass of the same-origin policy in the DOM: Notification component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 contains SAUCE patches that include a potential NULL pointer dereferencing issue in the handling of AppArmor notifications. This bug can be triggered by an unprivileged local user, and it can lead to a kernel panic...

Astra Linux – Vulnerability in Xen

Inappropriate x86 IOMMU timeout detection/handling: IOMMU processes commands that are issued in parallel with the operation of the CPUs that issue those commands. In the current implementation in Xen, asynchronous notifications of the completion of such commands are not used. Instead, the issuing...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 7.17, and 7.0 contain AppArmor SAUCE patches that, under certain circumstances, may use an uninitialized variable in notification handling code. This bug can be triggered by a non-privileged local user, and it can lead to incorrect caching of AppArmor notification responses...

Astra Linux – Vulnerability in Firefox and Thunderbird

A bug in the calculation of popup notification delays could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

CVE-2026-90467: Improper Neutralization of Argument Delimiters in a Command

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...

Exploit for Use After Free in Microsoft

CVE-2026-42978-PoC-Research CVE-2026-4...

CVE-2026-62106

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-62106

SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9 ) is affected by a Subscriber-level privilege escalation vulnerability. The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a low-privileged (Subscriber) user can achieve hi...

CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

EUVD-2026-76213

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-89263

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89263 MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89263

MoguBlog through version 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated remote attackers to disable email reply notifications for arbitrary users. The root cause is a missing authentication check in the endpoint handler, which perm...

CVE-2024-12145

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-12145 BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2024-55759

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-12145

The BuddyPress WordPress plugin (versions ≤ 14.3.3 ) is vulnerable to an Insecure Direct Object Reference in the bp_notifications_action_bulk_manage function, caused by missing validation on a user-controlled key. Authenticated attackers with Subscriber-level access or higher can delete or change...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...