CVE-2026-19653

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations...

CVE-2026-74481

A flaw was found in the Linux kernel's memory management, specifically within the page reporting mechanism. During system suspend or hibernation, the page reporting process could attempt to access memory that had already been freed by device drivers. This Use-After-Free vulnerability can lead to ...

CVE-2026-19653

A local attacker on IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 can trigger a denial of service by exploiting improper handling of memory page table configurations. CVSS 3.1 scores 6.5 (Medium) with HIGH availability impact; no exploitation evidence is provided. Monitor IBM support for patches.

EUVD-2026-62661

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations...

CVE-2026-19653 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations...

CVE-2026-72412

A flaw was found in the Linux kernel's memory management for s390 systems. An internal flag, intended to mark guest memory pages for discard after unmapping by the Kernel-based Virtual Machine KVM, was not consistently cleared when those pages were subsequently reused. This improper handling coul...

CVE-2026-72362

A flaw was found in the Linux kernel's drm/xe/pt module. This vulnerability arises when the page-table walk framework provides a null pointer for unpopulated entries, and the xeptzapptesentry function attempts to access this null pointer without prior validation. This improper handling can lead t...

CVE-2026-72358

A flaw was found in the Linux kernel's drm/xe/pt component. During page table walks for binding, specific functions xepthugeptepossible and xeptscan64K do not properly check if a Buffer Object BO has been purged. This oversight can lead to invalid access of an uninitialized cursor, potentially...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-74403

A flaw was found in the Linux kernel's Cryptographic Co-processor CCP driver. Under memory pressure, if a page allocation fails, the driver incorrectly processes the allocation result. This can lead to the dereferencing of an invalid memory address, potentially causing a system crash or other...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-74420

A flaw was found in the Linux kernel's GPU Shared Virtual Memory SVM subsystem. This vulnerability occurs when attempting to create an SVM range on Virtual Memory Areas VMAs that are not backed by physical page objects. An attacker could exploit this by triggering repeated page retrieval failures...

CVE-2026-76035

A flaw was found in Media in Google Chrome. This inappropriate implementation allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a compromise of the affected syste...

CVE-2026-14287

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-19056

The ProSolution WP Client WordPress plugin (versions before 2.0.11) fails to sanitise and escape the page parameter before reflecting it into an HTML attribute on an admin page, enabling reflected XSS in an administrator's session via a crafted request. CVSS 7.1 (HIGH). Remediation: update to ver...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

EUVD-2026-62270

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin (before 4.4.8) reflects unescaped query-string parameters on an admin page, enabling reflected XSS against administrators who click a crafted link. CISA SSVC reports no active exploitation. Update to version 4.4.8 to remediate.