Astra Linux – Vulnerability in mbedtls

A issue was discovered in Arm Mbed TLS before version 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Arm Mbed TLS before version 2.24.0. The function mbedtlsx509crlparseder has a buffer over-read of one byte...

Astra Linux – Vulnerability in StrongSwan

Before version 5.9.8, StrongSwan allowed remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity and intermediate CA certificate that contained a CRL/OCSP URL pointing to a server under the attacker’s control that did not respond properly. In some...

WordPress Temporary Login Without Password plugin < 1.9.9 - Authenticated Temporary Access Revocation Bypass vulnerability

Authenticated Temporary Access Revocation Bypass vulnerability discovered by BaptouTatis in WordPress Plugin Temporary Login Without Password versions 1.9.9...

Linux Distros Unpatched Vulnerability : CVE-2026-86231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file...

echoac-poc

CVE-2023-38817 关于 echo.ac 驱动中发现漏洞的 PoC 与详细分析。 CVE 信息 编号：CVE-2023-38817 厂商：Inspect Element Ltd 13017981，以 Echo 名义运营。 受影响产品：echo.ac 反作弊扫描工具。 受影响版本：echo.ac - 5.2.1.0，echodriver.sys - 所有已发布版本。 受影响操作系统：从 Windows 7 到 Windows 11 的 64 位 Windows 版本。 缓解措施：不要使用该软件，并将驱动签名加入黑名单。 证书已吊销 微软已将 Echo...

CVE-2026-77753 Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

EUVD-2026-76810

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin (versions before 1.9.9 ) contains an authenticated access revocation bypass . The plugin fails to prevent a temporary user from creating an Application Password and does not revoke it when the temporary access expires or is disabled. As a resu...

Linux Distros Unpatched Vulnerability : CVE-2026-89660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. Th...

CVE-2026-89663

A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...

CVE-2026-89660

A flaw was found in the Linux kernel's Network File System Daemon NFSD. This vulnerability, a use-after-free, occurs during the revocation of client administrative states. A race condition can allow a client's memory to be freed prematurely while still being referenced, potentially leading to...

DEBIAN-CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...

CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...

CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...

UBUNTU-CVE-2026-89660

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...

CVE-2026-89764 rust: devres: fix race between concurrent revokers

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

EUVD-2026-76615

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SCSTATUSFREED in nfsd4droprevokedstid for delegations nfsd4droprevokedstid handles FREESTATEID for admin-revoked delegations but does not set SCSTATUSFREED before releasing cllock. revokedelegation uses this flag to...

CVE-2026-89663

CVE-2026-89663 is a use-after-free vulnerability in the Linux kernel's nfsd (Network File System Daemon) subsystem, specifically in the revocation of copy-notify stateids. The root cause is that _free_cpntf_state_locked() drops a reference without unlinking the entry when a concurrent holder has ...

CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...