CVE-2026-15235

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...

PT-2026-66386

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

UBUNTU-CVE-2026-59900

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...

CVE-2026-59898

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers,...

CVE-2026-59900

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...

CVE-2026-59901

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-64312

A flaw was found in the Linux kernel's parallel cryptography pcrypt subsystem. When the system falls back to a non-parallel processing path, it fails to properly restore the original callback function and data. This oversight can lead to an asynchronous completion running an incorrect callback,...

EUVD-2026-50309

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65944

The Joomla Extension - rolandd.com is vulnerable to Cross-Site Request Forgery (CSRF) vectors within its AJAX endpoint handlers . This issue affects versions of RO CSVI prior to 9.11.0 . The vulnerability allows for unauthorized actions to be performed by a victim's browser. Specific exploitation...

CVE-2026-65946 Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

Security update for sssd

This update for sssd fixes the following issue: CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3401-1 Security update for sssd

This update for sssd fixes the following issue: - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807...

CVE-2026-64439

A flaw was found in the Linux kernel's Kerberos 5 krb5 cryptography module. This use-after-free vulnerability occurs when an asynchronous Authenticated Encryption with Associated Data AEAD instance is used. The system prematurely frees a memory buffer while a backend process still holds a pointer...

CVE-2026-14234

The WOLF WordPress plugin (specifically the WordPress Posts Bulk Editor and Manager ) versions prior to 1.1.0 is vulnerable to stored Cross-Site Scripting (XSS) . The root cause is a lack of nonce or capability checks on one of its AJAX actions , which enables an unauthenticated attacker to perfo...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin versions before 4.1.7 is vulnerable to Arbitrary File Disclosure and Server-Side Request Forgery (SSRF) . The root cause is the failure to validate a user-supplied parameter used in a file read operation within two AJAX actions accessible to unauthentica...

PT-2026-65691

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

PT-2026-65793

Name of the Vulnerable Software and Affected Versions RO CSVI versions prior to 9.11.0 Description Cross-Site Scripting XSS vectors exist within the AJAX endpoint handlers of the RO CSVI Joomla extension. XSS is a security flaw that allows an attacker to inject malicious scripts into web pages...

CVE-2026-56822

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...

CVE-2026-56822 Netty: TOCTOU in OcspServerCertificateValidator

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...

EUVD-2026-49994

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...