AZL-101373 CVE-2026-90022 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

CVE-2026-90022

CVE-2026-90022 is a use-after-free vulnerability in the Linux kernel 's USB gadget f_midi2 driver. The function f_midi2_opts_str_show() acquires the string lock internally, but its callers dereference the opts->info. pointer before calling it, outside the lock. This races with f_midi2_opts_str...

CVE-2026-89854

CVE-2026-89854 is a use-after-free in the Linux kernel's qla2xxx SCSI driver . During host teardown, qla84xx_put_chip() frees the ha->cs84xx chip structure without clearing the pointer, and it runs before scsi_remove_host() removes the 84xx_fw_version sysfs attribute. A concurrent read of that...

CVE-2026-89776 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

CVE-2026-89776 vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

CVE-2026-89776

CVE-2026-89776 affects the Linux kernel VXLAN VNI filter (vxlan: vnifilter). The root cause is that GROUP/GROUP6 address attributes were declared with NLA_BINARY and only a maximum length, allowing validate_nla() to accept payloads shorter than the address. The consumer then performs an unconditi...

CVE-2026-86444

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-84829

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-86444

The LearnPress WordPress plugin (versions 4.2.6.4–4.4.6 ) contains a reflected XSS vulnerability in the 'skin' parameter . A user-supplied value is not escaped before being inserted into an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the ...

EUVD-2026-80200

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

EUVD-2026-80191

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-92217

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

PT-2026-93301

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

UBUNTU-CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute i...

CVE-2021-28312

CVE-2021-28312 POC y descripción para CVE-2021-28312 Vulnerabilidad de denegación de servicio de Windows NTFS Enlace: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28312 Reproducción Desde cmd: escriba el siguiente comando cd c::$i30:$bitmap Posibilidad de explotación...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...