780 matches found
CVE-2026-13355
CVE-2026-13355 — Meta Box AIO Unauthenticated Administrator Privilege Escalation Python 3 proof-of-concept scanner and exploit for CVE-2026-13355 in the WordPress bundle Meta Box AIO and related MB Frontend Submission / MB User Profile extensions. | ---|--- Platform| WordPress plugin Component|...
aio-tinder (>=0.1.7, <=0.1.8) potentially affected by CVE-2026-111064 via aiohttp (1.0.1)
aiohttp PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.7, =0.1.8 Source cves: CVE-2026-111064 Source advisory: OSV:GHSA-5WR8-GCQF-GQF3...
aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2026-111064 via aiohttp (0.22.5)
aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2026-111064 Source advisory: OSV:GHSA-5WR8-GCQF-GQF3...
aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2026-111063 via aiohttp (0.22.5)
aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2026-111063 Source advisory: OSV:GHSA-494J-54XM-RWP3...
aio-tinder (>=0.1.7, <=0.1.8) potentially affected by CVE-2026-111063 via aiohttp (1.0.1)
aiohttp PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.7, =0.1.8 Source cves: CVE-2026-111063 Source advisory: OSV:GHSA-494J-54XM-RWP3...
aio-libs Async HTTP client/server framework Resource management error vulnerability
The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a resource management error vulnerability. This vulnerability stems from the Max-Age mechanism, which may cause overflows and skip closing connections. This could allow attackers to temporarily exhaust the connection po...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: aio: Fixed a use-after-free issue due to missing POLFREE handling. signalfdpoll and binderpoll are special because they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fixed race between aiocancel and AIO request complete FFS-based applications can utilize the aiocancel callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application...
Astra Linux – Vulnerability in Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCBAIORW before the conversion of struct aiokiocb. The first argument of kiocbset Cancelfn may point to a struct kiocb that is not embedded within struct aiokiocb. With the current code, depending on the compiler,...
PYSEC-2026-4244 Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 C extension lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value object. The...
CVE-2026-97205
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing “include virtual” commands may trigger a Use-After-Free UAF in the NGINX worker process...
EUVD-2026-101115
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing “include virtual” commands may trigger a Use-After-Free UAF in the NGINX worker process...
Use-after-free when using asynchronous file I/O (AIO)
Use-after-free when using asynchronous file I/O AIO Severity: medium CVE-2026-97205 Not vulnerable: 1.31.7+, 1.30.6+ Vulnerable: 0.8.11-1.31.6...
nginx -- multiple vulnerabilities
The nginx developers report: A buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path CVE-2026-15176. A buffer overflow might occur in a worker process while evaluating string...
EulerOS 2.0 SP13 : libkcapi (EulerOS-SA-2026-4153)
According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an...
EulerOS 2.0 SP13 : libkcapi (EulerOS-SA-2026-4062)
According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an...
CVE-2026-39761
Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...
CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Meta Box AIO = 3.7.1 versions...
