UBUNTU-CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-14229 ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...

CVE-2026-74408

The Linux kernel WiFi driver ath9k has a vulnerability (CVE-2026-74408) where ath_tx_edma_tasklet() accesses sc-&gt;tx.txq[ts.qid] with ts.qid being a 4-bit field (0-15) while the txq array supports only ATH9K_NUM_TX_QUEUES (10). A qid of 10 or higher causes an out-of-bounds access. The documente...

EUVD-2026-59555

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-8840

The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...

PT-2026-72873

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the uvcvideo module when a UVC camera utilizes an asynchronous control. The issue arises when the uvc status stop function is called from async ctrl.work through the...

PT-2026-72149

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System versions prior to 3.2.37 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can wri...

PT-2026-72844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB array access occurs in the ath tx edma tasklet function. The function accesses sc-tx.txqts.qid, where ts.qid is a 4-bit hardware field with a range of 0 to 15...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext-vscode is a Theia - Plugin Extension for VsCode Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute...

MINI-HPX3-4PVV-WF6P

Bulletin has no description...

WordPress TLP Food Menu plugin < 6.0.2 - Unauthenticated Reservation Status Modification vulnerability

Unauthenticated Reservation Status Modification vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions 6.0.2...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, falcoctl-fips, helm-operator-fips, rancher-fleet, cilium-cli, rancher-fleet-fips, kyverno, rancher-helm, kube-mgmt, kube-arangodb, helm-push, vcluster, helm-exporter, helm-set-status, oras-fips, trivy-fips, trivy, oras, ocm-cli-fips,...

GO-2026-5338 vulnerabilities

Vulnerabilities for packages: kubescape, tw, kubescape-operator, trivy-operator, neuvector-scanner, linkerd2, k8ssandra-client, k3s, steampipe, scorecard, chartmuseum, zot, datadog-agent, trivy, tigera-operator, falco-no-driver, zarf, skaffold, consul-k8s, rancher, buildkitd, eksctl,...

GO-2026-5475 vulnerabilities

Vulnerabilities for packages: kubescape, tw, kubescape-operator, trivy-operator, neuvector-scanner, linkerd2, k8ssandra-client, k3s, steampipe, scorecard, chartmuseum, k8sgpt, zot, datadog-agent, trivy, tigera-operator, falco-no-driver, zarf, skaffold, consul-k8s, rancher, buildkitd, eksctl,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: nerdctl, opa, kubescape, tw, kubescape-operator, trivy-operator, neuvector-scanner, k8ssandra-client, k3s, steampipe, flux-source-controller, chartmuseum, k8sgpt, zot, trivy, falco-no-driver, zarf, skaffold, buildkitd, eksctl, fuse-overlayfs-snapshotter, helm-operato...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: kubescape, trivy-operator, istio, linkerd2, chart-testing, k8ssandra-client, flux-source-controller, cerbos, k8sgpt, chartmuseum, zot, trivy, zarf, eksctl, nova, helm-operator, helm-set-status, cilium-cli, kots, pluto, flux, cert-manager-cmctl, helm-push, k9s,...

GO-2026-5884 vulnerabilities

Vulnerabilities for packages: kubescape, tw, trivy-operator, linkerd2, k8ssandra-client, steampipe, ratify, chartmuseum, trivy, gitness, tigera-operator, zarf, vcluster, opentofu, consul-k8s, maru, conftest, rancher, eksctl, oras, helm-operator, kube-arangodb, helm-set-status, gatekeeper, argo-cd...