LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write

LeadConnector WordPress plugin 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication. id: CVE-2026-1890 info: name: LeadConnector 3.0.22 - Unauthenticated...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fixed a use-after-free in the iomap inline data write path The inline data buffer head dibh is released prematurely in gfs2iomapbegin via releasemetapath, while iomap-inlinedata still points to dibh-bdata. This causes a...

DEBIAN-CVE-2026-101338

When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...

CVE-2026-101338

When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...

CVE-2026-101338

The NSD name server is vulnerable to a stack-based buffer overflow (CWE-121) when processing specially crafted SVCB or HTTPS resource records (RR ). If the wire format RDATA is filled to its limit, an additional ECH parameter can overwrite the stack. Furthermore, if the limit is exceeded, the bas...

CVE-2026-106571

A flaw was found in ImageMagick. A local attacker can cause a Denial of Service DoS by issuing a specially crafted call to the GetVirtualPixels function. An integer calculation error allows data to be written beyond allocated heap memory boundaries, resulting in an unexpected process crash...

kernel: gfs2: Fix use-after-free in iomap inline data write path

A flaw was found in the Linux kernel's GFS2 filesystem. This memory corruption vulnerability, a use-after-free, occurs in the iomap inline data write path. The issue arises because a data buffer is released prematurely while still being referenced, leading to a write to freed memory. This could...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: fixed the bug in ext4writepages We encountered the following issue: EXT4-fs error device loop0: ext4mbgeneratebuddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls ------------ cut here...

SUSE CVE-2026-98161

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

AlmaLinux 9.2 [TuxCare] Security Update: procps-ng / procps-ng-devel / procps-ng-i18n (ALMALINUX9.2:CLSA-2024:1718202251)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718202251 advisory. - Under some circumstances, this weakness allows a user who has access to run the ps utility on a machine, the ability to write almost...

AZL-105735 CVE-2026-103111 affecting package qtbase 6.6.3-6

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (CENTOS7:CLSA-2026:1770820858)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1770820858 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap...

AZL-104201 CVE-2026-98161 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

PT-2026-98844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pmem submit bio function where a REQ PREFLUSH error is recorded but the process continues to copy bio data. This can lead to the error being overwritten by a...

OESA-2026-3905 openjdk-1.8.0 security update

The OpenJDK runtime environment 8. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11,...

CVE-2026-83346

Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware component: Framework. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-75706

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...

PT-2026-85289

Name of the Vulnerable Software and Affected Versions core-moos versions prior to 10.4.1 Description A pre-authentication heap overflow exists in MOOSCommPkt packet handling. Remote attackers can write arbitrary data by declaring a negative packet length. This is achieved by exploiting a signed...

EUVD-2026-66245

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file...

VulnCheck KEV: CVE-2026-66384

JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions...