CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64572

CVE-2026-64572 affects the Linux kernel's IPv4 FIB path. In fib_table_insert(), new_fa is published to the leaf’s fa_list before notifiers run; if a notifier fails, the code removes new_fa via fib_remove_alias() and frees it with kmem_cache_free(). A concurrent, already-reached reader in fib_tabl...

EUVD-2026-53184

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

EUVD-2026-53181

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdatacommentcount parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied...

CVE-2026-18881

CVE-2026-18881 affects the TableOn WordPress Posts Table Filterable plugin for WordPress, up to version 1.0.5.1. The vulnerability is a blind SQL injection in the public AJAX action tableon_get_table_data, triggered by the parameter filter_data[comment_count]. The value is split on ":" and interp...

EUVD-2026-53172

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

PT-2026-68185

Name of the Vulnerable Software and Affected Versions Flarum versions prior to 1.8.16 Description Improper session invalidation allows attackers with a valid session token to maintain full account access even after a password change. This occurs because the access tokens table is not cleared duri...

PT-2026-68018

Name of the Vulnerable Software and Affected Versions TableOn – WordPress Posts Table Filterable versions prior to 1.0.5.2 Description Unauthenticated attackers can perform blind SQL Injection through the filter datacomment count parameter of the public tableon get table data AJAX action. The iss...

PT-2026-68055

Name of the Vulnerable Software and Affected Versions Search Analytics for WP versions prior to 1.4.17 Description The plugin is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or...

CVE-2026-18881: Improper Neutralization of Special Elements used in an SQL Command

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdatacommentcount parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied...

CVE-2026-39924: Insufficient Session Expiration

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

PT-2026-67949

Name of the Vulnerable Software and Affected Versions PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin versions prior to 3.6.21 Description An issue exists where authenticated attackers with Administrator-level access and above can perform SQL...

MAL-2026-11798 Malicious code in @qlik/nebula-table-utils (npm)

npm/@qlik/nebula-table-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11809 Malicious code in @qlik/sprout-react-table (npm)

npm/@qlik/sprout-react-table is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-67196

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-67199 Perspective 5.0.0 DoS via Loop Expression Evaluation

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-67199

CVE-2026-67199 affects Perspective 5.0.0. The vulnerability arises from evaluating an expression in a TableMakeViewReq message that can contain unbounded for/while loop constructs. An attacker can embed an arbitrarily large iteration count in a single expression column evaluated per table row, ca...

CVE-2026-67198

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with ...