CVE-2026-45295 FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/conversationid/threadid allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state openedat...

CVE-2026-12972

creationtimestamp| type| source ---|---|--- 2026-07-20 08:00:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2t7xjkpw2s...

CVE-2026-64123

A flaw was found in the Linux kernel's High-availability Seamless Redundancy HSR networking component. When HSR node-list and node-status operations are performed, a generic-netlink reader might retain a pointer to a freed node table. This can lead to a use-after-free vulnerability, potentially...

CVE-2026-12973 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin, in versions before 8.2.2 , contains a vulnerability where it fails to perform authorization or order-ownership validation for a specific AJAX action . This flaw is accessible to unauthenticated users , potentially allowing them to disclose the secret ...

CVE-2026-12973 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

CVE-2026-53388

creationtimestamp| type| source ---|---|--- 2026-07-20 04:55:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116950519672202204 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-10564

creationtimestamp| type| source ---|---|--- 2026-07-20 01:07:25+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr245a72ph2y...

K000162336: PHP vulnerability CVE-2026-6735

Security Advisory Description In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code XSS on the target's machi...

CVE-2026-12973: Missing Authorization

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

Linux Distros Unpatched Vulnerability : CVE-2026-64066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued...

Linux Distros Unpatched Vulnerability : CVE-2026-64102

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen,...

Linux Distros Unpatched Vulnerability : CVE-2026-63873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mmstruct reference leak in aie2populaterange aie2populaterange jumps back...

GHSA-CFCQ-76GR-62X8

creationtimestamp| type| source ---|---|--- 2026-07-19 21:03:21+00:00| seen| https://bsky.app/profile/releaseport.com/post/3mqzojds3zg2g...

SUSE CVE-2026-15900

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

SUSE CVE-2026-56852

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-64185

creationtimestamp| type| source ---|---|--- 2026-07-19 17:09:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqzbgngcud2e 2026-07-19 18:25:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzfooiglt23 2026-08-03 09:19:48+00:00| seen|...

CVE-2026-64148

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...

CVE-2026-63961

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

CVE-2026-63927

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usbhcdgivebackurb so save the urb-status ahead of time...