Linux Kernel Security Vulnerabilities

The Linux kernel version 6.19 contains security vulnerabilities. These vulnerabilities stem from binderfs’ binderadddevice function, which accesses freed objects after simpledonecreating releases the parent directory lock and dentry references. Concurrently, unlinkat can delete the new device ent...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains a security vulnerability. This vulnerability stems from the data reading function of the rohm-bm1390 driver, which ignores incorrect cached values and returns 0. After the measurement stops, the cached ret value is not returned, potentially leading to the...

Linux Kernel Security Vulnerabilities

The Linux kernel versions 6.12.111 to 6.12.112, 6.18.53 to 6.18.55, and 7.2 have security vulnerabilities. These vulnerabilities stem from the rfcommrecvframe function, which fails to properly check the frame length when EA=0 and ignores the return value of skbpull. As a result, a 3-byte rfcommhd...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.12.78 to 6.12.113, from 6.18.20 to 6.18.56, from 6.19.10 to 6.20, and 7.0 contain security vulnerabilities. These vulnerabilities stem from the failure to convert the size parameter to a ssizet type during the hidbpfhwrequest check. As a result, the negative error...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains security vulnerabilities. These vulnerabilities stem from the fact that in the function cd321xupdatework, the variable typecpartnerdesc is not initialized to zero. Only the variables usbpd, accessory, and identity are initialized. As a result, fields such as...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.12 contains security vulnerabilities. These vulnerabilities stem from the netfsreadgaps function, which does not clear the read gaps surrounding the streaming write to the dirty area. As a result, short reads on the server side or EOF responses may retain outdatedfolio...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 6.1.110 through 6.2, 6.6.51 through 6.7, 6.10.10 through 6.11, and 6.11 itself. These vulnerabilities stem from smb3zerorange, which only conditionally refreshes dirty data when simulating FALLOCFLZERORANGE. It does not refresh the data...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.32 contains security vulnerabilities. These vulnerabilities stem from the fact that the fields invalidHandle, swapfile, oplockbreakcancelled, offload, and statusfiledeleted in the cifsFileInfo structure share the same byte. When different code paths concurrently updat...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 6.12.113, 6.18.56, and 7.2.10 contain security vulnerabilities. These vulnerabilities stem from the viovcc structure used in vccsendctl, where the packet associated with the stack allocation is not fully initialized. As a result, the tag.stypeenv field is not...

CVE-2026-110889 WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4...

CVE-2026-110889 WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4...

CVE-2026-110889

The Gantry 5 Framework WordPress plugin (versions

CVE-2026-106470

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 M365 credential belonging to ConnectWise Cloud Backup formerly SkyKick to gain unauthorized access to customers' M365 environments. ConnectWise Clo...

CVE-2026-106470 WP Data Access < 5.5.88 - Subscriber+ SSRF

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

CVE-2026-106470

The WP Data Access WordPress plugin version before 5.5.88 is vulnerable to a Server-Side Request Forgery (SSRF) due to a lack of authorisation and CSRF checks in one of its actions. This flaw allows any authenticated user , such as a subscriber, to force the server to open connections to arbitrar...

WordPress WP Data Access plugin < 5.5.88 - Subscriber+ SSRF vulnerability

Subscriber+ SSRF vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions 5.5.88...

CVE-2026-106470 WP Data Access < 5.5.88 - Subscriber+ SSRF

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

EUVD-2026-103256

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

CVE-2026-107762

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...