CVE-2026-13345 Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private...

CVE-2026-13345

CVE-2026-13345 affects the WordPress plugin Essential Addons for Elementor prior to version 6.6.10. The vulnerability arises from missing authorization, status, and visibility checks in the plugin’s product-comparison feature when resolving WooCommerce products, allowing unauthenticated users to ...

GHSA-85RG-P3FR-XC2F QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Impact The relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Impact The relay's reconnect handler forwards every RECONNECTREQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send...

Linux Distros Unpatched Vulnerability : CVE-2026-17512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function logmelspectrogram of the file src/whisper.cpp. The manipulation leads...

CVE-2026-64362

A flaw was found in the Linux kernel's lg-g15 Human Interface Device HID driver. This vulnerability, a use-after-free, occurs when a Logitech G15, G15 v2, or G510 keyboard is unplugged while a work item is pending. The driver fails to properly cancel this pending work, allowing it to access memor...

DEBIAN-CVE-2026-17501

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

DEBIAN-CVE-2026-17500

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance...

UBUNTU-CVE-2026-17500

A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function visitpattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance...

CVE-2026-17501

CVE-2026-17501 affects ggml-org llama.cpp within the JSON-Schema-to-GBNF Conversion pipeline, specifically the transform function in common/json-schema-to-grammar.cpp. The issue involves resource allocation during processing, with remote initiation possible per the description, and a fix pull req...

HID: lg-g15: cancel pending work on remove to fix a use-after-free

...

SUSE CVE-2026-64362

In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lgg15data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lgg15event and lgg15v2event do it on th...

SUSE CVE-2026-64502

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the magick when invalid command-line options are provided. An attacker can cause memory exhaustion by repeatedly supplying malformed command-line arguments. Remediation A fix was...

UBUNTU-CVE-2026-64362

In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lgg15data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lgg15event and lgg15v2event do it on th...

EUVD-2026-48846

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...

CVE-2026-64502 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...

CVE-2026-64502

CVE-2026-64502 affects the Linux kernel IIO ADC driver (ad_sigma_delta) for devices with has_registers = false and optional rdy_gpiod. The underlying issue was in ad_sigma_delta_clear_pending_event(): reading the status path could consume a pending conversion data, corrupt the stream, and, with n...

CVE-2026-64502 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...

CVE-2026-64502

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix clearpendingevent for registerless devices adsigmadeltaclearpendingevent falls through to the status register read path for devices with hasregisters = false and no rdygpiod. For such devices,...