1876 matches found
Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
Caddy v2.11.3 — Three vulnerabilities in handler/placeholder layer Tested against: caddy:2.11.3 official Docker image, SHA verified at runtime Reproduction environment: Docker Desktop 4.73.1 / Engine 29.4.3 on Windows 10 host, isolated containers, no network egress required for any of the exploit...
CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...
CVE-2026-86796 WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters
The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...
CVE-2026-86796
Hide My WP Ghost (WP Ghost) WordPress plugin versions before 7.0.11 contain an unauthenticated bypass of its firewall, threat-detection, and login/URL-hiding protections. The root cause is that the plugin does not verify a request is a genuine WooCommerce request before disabling those protection...
CVE-2026-86800: Protection Mechanism Failure
The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...
CVE-2026-77281 Caddy: rewrite placeholder re-expansion
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...
CVE-2026-77281 Caddy: rewrite placeholder re-expansion
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...
CVE-2026-77281 Caddy: rewrite placeholder re-expansion
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...
CVE-2026-90295
In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs: imx6socvolt = devmkcalloccpudev, num, sizeofimx6socvolt, GFPKERNEL; but it is fill...
CVE-2026-90193 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...
EUVD-2026-81786
In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...
CVE-2026-90193
This CVE affects the qcom-cpucp mailbox driver in the Linux kernel under PREEMPT_RT configurations. The root cause is a lock re-entrancy deadlock : qcom_cpucp_mbox_irq_fn() invokes mbox_chan_received_data() while holding chan->lock. Under PREEMPT_RT, spin_lock_irqsave() is converted to an rt_s...
CVE-2026-89991
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...
DEBIAN-CVE-2026-89991
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...
CVE-2026-89991 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...
CVE-2026-89991
CVE-2026-89991 is a bug in the Linux kernel BPF subsystem affecting __pcpu_freelist_push(). When only one CPU is possible (e.g., CONFIG_SMP=n or nr_cpus=1), an NMI re-enters pcpu_freelist_push() while the interrupted context already holds that CPU's freelist lock. The fallback loop skips the curr...
EUVD-2026-80599
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...
CVE-2026-89991 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...
CVE-2026-88255 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot
Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/2, keyed...
CVE-2026-88255 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot
Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/2, keyed...