599862 matches found
CVE-2026-14229
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...
CVE-2026-16611
The Product Feed PRO for WooCommerce plugin (before 13.5.7) exposes a REST read route without authorization checks, letting unauthenticated attackers retrieve feed rules, filters, field mappings, and the full product category taxonomy. CVSS 3.1 scores this HIGH (7.5) for confidentiality impact. E...
CVE-2026-16611 Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...
CVE-2026-14229
The ECS WordPress plugin before version 4.3.8 lacks capability and post-status checks on its AJAX rendering action (ecsload), allowing unauthenticated attackers to retrieve rendered content of unpublished posts (private, draft, pending) by supplying a document identifier. CVSS 5.3 MEDIUM; CISA fl...
EUVD-2026-59590
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...
EUVD-2026-59587
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished private, draft, pending documents by supplying thei...
CVE-2026-16541
The Simply Schedule Appointments WordPress plugin (before 1.6.12.17) exposes user names and email addresses via its Users and Customers REST endpoints to any authenticated Team Member+ role, requiring only low privileges; the fix is to upgrade to version 1.6.12.17. No exploitation evidence is pro...
EUVD-2026-59588
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
EUVD-2026-59577
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...
CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...
EUVD-2026-59555
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...
CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...
CVE-2026-74408
The Linux kernel WiFi driver ath9k has a vulnerability (CVE-2026-74408) where ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] with ts.qid being a 4-bit field (0-15) while the txq array supports only ATH9K_NUM_TX_QUEUES (10). A qid of 10 or higher causes an out-of-bounds access. The documente...
EUVD-2026-59530
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...
CVE-2026-74361 nvme: fix FDP fdpcidx bounds check
In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...
CVE-2026-74349
In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2trimmainbm trims the global bitmap in cluster units, but its too-short range validation only checks sb-sblocksize. On filesystems with a cluster size larger than the block...
CVE-2026-74336 wifi: mac80211: bound S1G TIM PVB walk to the TIM element
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...
CVE-2026-74312
The CVE-2026-74312 entries describe a Linux kernel vulnerability in vhost/vdpa where mmap and fault paths use vma->vm_pgoff as a virtqueue index without proper bounds validation against v->nvqs. This allowed an out-of-range queue index to reach driver callbacks via get_vq_notification(), un...
EUVD-2026-59459
In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhostvdpammap and vhostvdpafault use vma-vmpgoff as a virtqueue index for getvqnotification, but they do not validate that the index is smaller than v-nvqs. The ioctl...
EUVD-2026-59452
In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...