CVE-2026-111884

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

EUVD-2026-103335

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.4 contains a security vulnerability. This vulnerability arises from the fact that the firmware download reception path removes the NCI data header before verifying the length of the remaining packets, and reads the helper command. As a result, short frames can access th...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains a security vulnerability. This vulnerability arises from the fact that streamconfig is not initialized before being passed to sdwstreamaddslave. As a result, the type field may contain invalid values, which are then copied to stream-type by sdwconfigstream...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.3 contains a security vulnerability. This vulnerability stems from the use of “Exception info %s” in the btintelHWerror function, where the print statement utilizes skb-data + 1. Additionally, the 12-byte payload does not end with NULs, potentially leading to excessive...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions from 6.12.81 to 6.12.113, from 6.18.22 to 6.18.56, from 6.1.168 to 6.2, from 6.6.134 to 6.7, from 6.19.12 to 6.20, and 7.0. The vulnerability stems from incomplete detection of IPv6 extension headers in tunneled data packets. The system...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.35 has a security vulnerability. This vulnerability arises from hifusbtx, which limits TX aggregation by the number of records, rather than by the cumulative byte length. As a result, memcpy may exceed the bounds and write data into txbuf-buf, potentially causing memo...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.19 has a security vulnerability. This vulnerability stems from improper locking and serialization in Bluetooth SMP remote OOB data access. The buildpairingcmd function searches for and copies remote OOB data without holding the hdev-lock. This may lead to post-release...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.14 contains a security vulnerability. This vulnerability arises from the fact that advancenextseg and seg6nextcsidadvancearg do not ensure that the data of the packet can be written before modifying the Segments Left field of SRH and the IPv6 destination address. As a...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 5.10.50 through 5.11, 5.12.17 through 5.13, 5.13.2 through 5.14, and 5.14 itself. These vulnerabilities stem from SMB clients, which perform the FALLOCFLKEEPSIZE fallocate simulation in smb3simplefallocaterange. During this process, dat...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.15 contains a security vulnerability. This vulnerability stems from the fact that typecpartnerdesc is not initialized in tps6598xconnect. As a result, uninitialized function pointers may be called, and stack data may be leaked through the partner sysfs...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.18 contains security vulnerabilities. These vulnerabilities stem from the fact that the tcpwritecollapsefence function does not take effect when skwritequeue is empty. This may lead to the merging of skb packets across device encryption boundaries during retransmission ...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.19 contains security vulnerabilities. These vulnerabilities stem from binderfs’ binderadddevice function, which accesses freed objects after simpledonecreating releases the parent directory lock and dentry references. Concurrently, unlinkat can delete the new device ent...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains a security vulnerability. This vulnerability stems from the data reading function of the rohm-bm1390 driver, which ignores incorrect cached values and returns 0. After the measurement stops, the cached ret value is not returned, potentially leading to the...

Linux Kernel Security Vulnerabilities

The Linux kernel versions 6.12.111 to 6.12.112, 6.18.53 to 6.18.55, and 7.2 have security vulnerabilities. These vulnerabilities stem from the rfcommrecvframe function, which fails to properly check the frame length when EA=0 and ignores the return value of skbpull. As a result, a 3-byte rfcommhd...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 6.12.78 to 6.12.113, from 6.18.20 to 6.18.56, from 6.19.10 to 6.20, and 7.0 contain security vulnerabilities. These vulnerabilities stem from the failure to convert the size parameter to a ssizet type during the hidbpfhwrequest check. As a result, the negative error...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains security vulnerabilities. These vulnerabilities stem from the fact that in the function cd321xupdatework, the variable typecpartnerdesc is not initialized to zero. Only the variables usbpd, accessory, and identity are initialized. As a result, fields such as...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.12 contains security vulnerabilities. These vulnerabilities stem from the netfsreadgaps function, which does not clear the read gaps surrounding the streaming write to the dirty area. As a result, short reads on the server side or EOF responses may retain outdatedfolio...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 6.1.110 through 6.2, 6.6.51 through 6.7, 6.10.10 through 6.11, and 6.11 itself. These vulnerabilities stem from smb3zerorange, which only conditionally refreshes dirty data when simulating FALLOCFLZERORANGE. It does not refresh the data...