CVE-2026-111889

phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read...

EUVD-2026-103330

phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read...

CVE-2026-111884

The phpMyFAQ application versions prior to 4.1.9 and 4.2.0-alpha (before 4.2.0-beta ) are vulnerable to an account takeover flaw. The software fails to require the current password when a user updates their account email via the user control panel (specifically UserController::updateData and api/...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

EUVD-2026-103335

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains a security vulnerability. This vulnerability arises from the fact that streamconfig is not initialized before being passed to sdwstreamaddslave. As a result, the type field may contain invalid values, which are then copied to stream-type by sdwconfigstream...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.4 contains a security vulnerability. This vulnerability arises from the fact that the firmware download reception path removes the NCI data header before verifying the length of the remaining packets, and reads the helper command. As a result, short frames can access th...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains a security vulnerability. This vulnerability stems from the data reading function of the rohm-bm1390 driver, which ignores incorrect cached values and returns 0. After the measurement stops, the cached ret value is not returned, potentially leading to the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.19 contains security vulnerabilities. These vulnerabilities stem from binderfs’ binderadddevice function, which accesses freed objects after simpledonecreating releases the parent directory lock and dentry references. Concurrently, unlinkat can delete the new device ent...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 6.1.110 through 6.2, 6.6.51 through 6.7, 6.10.10 through 6.11, and 6.11 itself. These vulnerabilities stem from smb3zerorange, which only conditionally refreshes dirty data when simulating FALLOCFLZERORANGE. It does not refresh the data...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.35 has a security vulnerability. This vulnerability arises from hifusbtx, which limits TX aggregation by the number of records, rather than by the cumulative byte length. As a result, memcpy may exceed the bounds and write data into txbuf-buf, potentially causing memo...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains security vulnerabilities. These vulnerabilities stem from the fact that in the function cd321xupdatework, the variable typecpartnerdesc is not initialized to zero. Only the variables usbpd, accessory, and identity are initialized. As a result, fields such as...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.14 contains a security vulnerability. This vulnerability arises from the fact that advancenextseg and seg6nextcsidadvancearg do not ensure that the data of the packet can be written before modifying the Segments Left field of SRH and the IPv6 destination address. As a...

Linux Kernel Security Vulnerabilities

The Linux kernel versions 6.12.111 to 6.12.112, 6.18.53 to 6.18.55, and 7.2 have security vulnerabilities. These vulnerabilities stem from the rfcommrecvframe function, which fails to properly check the frame length when EA=0 and ignores the return value of skbpull. As a result, a 3-byte rfcommhd...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.12 contains security vulnerabilities. These vulnerabilities stem from the netfsreadgaps function, which does not clear the read gaps surrounding the streaming write to the dirty area. As a result, short reads on the server side or EOF responses may retain outdatedfolio...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 5.10.50 through 5.11, 5.12.17 through 5.13, 5.13.2 through 5.14, and 5.14 itself. These vulnerabilities stem from SMB clients, which perform the FALLOCFLKEEPSIZE fallocate simulation in smb3simplefallocaterange. During this process, dat...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions from 6.12.81 to 6.12.113, from 6.18.22 to 6.18.56, from 6.1.168 to 6.2, from 6.6.134 to 6.7, from 6.19.12 to 6.20, and 7.0. The vulnerability stems from incomplete detection of IPv6 extension headers in tunneled data packets. The system...