CVE-2026-13146

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC 힙 버퍼 오버런 KVM의 SEV-SNP 페이지 상태 변경PSC 처리에서 발생하는 힙 읽기 및 쓰기 오버플로우에 대한 개념 증명입니다. 악의적인 SEV-SNP 게스트가 호스트 커널로 하여금 PSC 항목 배열을 슬랩 할당 영역 끝까지 탐색하게 만듭니다. 이로 인해 인접한 kmalloc-cg-32 객체의 레이아웃이 유출되고, 제어된 작은 값이 그 객체에 기록되며, 게스트는 이를 원하는 만큼 반복할 수 있습니다. 전체 분석:...

CVE-2026-84469

A flaw was found in fastify. An unauthenticated remote attacker can bypass request validation by exploiting how fastify processes boolean false schemas. When an application intends to deny all input by assigning 'false' to a route's schema, fastify incorrectly treats it as a missing schema and...

CVE-2026-73730

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...

CVE-2026-73706

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker to gain insight into internal servic...

PT-2026-84428

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Privilege escalation issues exist in the API of HPE Networking Fabric Composer. An authenticated user with low privilege operator permissions can exploit this to modify...

CVE-2026-80581 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC errors for pipeline state change if the firmware state is crashed or the IPC has timed out. If the firmware has crashed the kernel still needs t...

Winter: CSRF through AJAX handler names reachable as backend page actions

Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level GET navigation with no CSRF token. Backend\Classes\Controller::actionExists accepted any public method on a controller as a page action, so handler-shaped names were never reserved from URL...

EUVD-2026-63538

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

CVE-2026-73162

CVE-2026-73162 affects MISP cti-transmute where several state-changing endpoints were exposed as unauthenticated GET requests: /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read. The underlying issue is CSRF risk because these authenticated ...

CVE-2026-13389

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-13389

CVE-2026-13389 affects the WordPress plugin webtoffee-cookie-consent, prior to version 3.5.3. The flaw is improper authorization on several REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and alter the plugin’s licensing state...

CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Requires the use of a scratch area if GHCB v2+ is in use According to the GHCB specification, when using GHCB v2+, it is required that the software scratch area resides in the GHCB’s shared buffer. Note that features li...

CVE-2026-63938

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM Secure Encrypted Virtualization SEV feature. When processing Page State Change PSC requests, the system does not properly validate the PSC buffer against the effective size of the scratch area. This can occur if a guest...

CVE-2026-63939

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV support. This vulnerability arises from an incorrect calculation of the maximum length for the in-Guest-Host Communication Block GHCB scratch area. When processing Page State Change PS...

CVE-2026-63937

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM with Secure Encrypted Virtualization SEV. This time-of-check to time-of-use TOCTOU vulnerability exists when KVM processes the guest-accessible Page State Change PSC buffer. A misbehaving guest could exploit this timing issue...

SUSE CVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

SUSE CVE-2026-63938

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...