41946 matches found
CVE-2026-89595
In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a...
CVE-2026-89447
CVE-2026-89447 affects the Linux kernel iommufd subsystem. In iommufd_access_notify_unmap() , the code calls iommufd_lock_obj() before checking whether the access is internal. When the access is internal, the loop skips it via continue, bypassing the matching iommufd_put_object() call used by the...
CVE-2026-89447 iommufd: Avoid locking internal accesses during unmap
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...
CVE-2026-89447 iommufd: Avoid locking internal accesses during unmap
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...
EUVD-2026-76353
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...
EUVD-2026-76319
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...
CVE-2026-80996 net: l2tp: do not propagate multicast notification errors
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...
CVE-2026-80996 net: l2tp: do not propagate multicast notification errors
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...
CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring
In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...
CVE-2026-80946
This Linux kernel vulnerability affects the FUSE-io-uring transport. The fuse_request slab cache (fuse_req_cachep) is created without a usercopy whitelist , so directly copying req->in.h to the ring or req->out.h back from the ring trips CONFIG_HARDENED_USERCOPY , triggering a kernel panic ...
CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring
In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...
CVE-2026-81915
Concrete CMS below 9.5.3 has a missing object-level authorization check in the Types::submit() dashboard controller. When updating a Page Type, the controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user a...
CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...
CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...
CVE-2026-81915 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...
EUVD-2026-76249
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType, so a signed-in dashboard user permitted to edit one...
WordPress The Events Calendar plugin <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution vulnerability
Unauthenticated PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin The Events Calendar versions = 6.17.4...
CVE-2026-62134
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...