CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84657

In Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), the build CLI command with the -s flag does not check the Item/Cancel permission when canceling a build after the CLI client is interrupted. Because Jenkins merges duplicate build requests into a single queue item, an attacker holding only I...

PT-2026-84780

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-80311

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

CVE-2026-80311 Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

EUVD-2026-68060

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

CVE-2026-80311

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 contains an insecure direct object reference (IDOR) flaw: it does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it. This allows a user with a confirmed ...

EUVD-2026-67574

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email...

WordPress User Registration & Membership plugin < 5.2.5 - Subscriber+ Pending Email Change Cancellation vulnerability

Subscriber+ Pending Email Change Cancellation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.5...

UBUNTU-CVE-2026-74745

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure that rdmaaddrcancel is executed before issuing more requests. The FSM can enter a loop, allowing rdmaresolveip to be called twice with the same idpriv. Although this cannot occur without going through the process...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fixed a use-after-free bug in qediremove. In qediprobe, we call qediprobe, which initializes &qedi-recoverywork with qedirecoveryhandler and &qedi-boarddisablework with qediboarddisablework. When...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fixed a potential use-after-free issue in the work function. When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer called...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac – Fixed a use-after-free bug in brcmfcfg80211detach. This is the candidate patch for CVE-2023-47233: https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In the brcm80211 driver, the process starts with the following...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921 – fixed a crash that occurred during startup failure. If the network interface card fails to start, it is possible that the resetwork task has already been scheduled. Ensure that this task is canceled so that a...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys – cancels delayed work only in case of GPIO. The gpiokeys module can accept gpios or interrupts. The module initializes delayed work only in case of gpios, and it is only used if the debounce timer is not used...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - dm integrity: Fixed a UAF Use-after-Free in dmintegritydtr. - dmintegrity also has the same UAF problem when dmresume and dmdestroy are executed concurrently. Therefore, the timer is canceled again in dmintegritydtr...

CVE-2026-74725

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-19416

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

EUVD-2026-62289

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...