Linux Kernel Security Vulnerabilities

The Linux kernel version 4.3 contains a security vulnerability. This vulnerability stems from the use of “Exception info %s” in the btintelHWerror function, where the print statement utilizes skb-data + 1. Additionally, the 12-byte payload does not end with NULs, potentially leading to excessive...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.4 contains a security vulnerability. This vulnerability arises from the fact that the firmware download reception path removes the NCI data header before verifying the length of the remaining packets, and reads the helper command. As a result, short frames can access th...

Linux Kernel Security Vulnerabilities

There are security vulnerabilities in Linux kernels versions 5.10.50 through 5.11, 5.12.17 through 5.13, 5.13.2 through 5.14, and 5.14 itself. These vulnerabilities stem from SMB clients, which perform the FALLOCFLKEEPSIZE fallocate simulation in smb3simplefallocaterange. During this process, dat...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 6.12.113, 6.18.56, and 7.2.10 contain security vulnerabilities. These vulnerabilities stem from the viovcc structure used in vccsendctl, where the packet associated with the stack allocation is not fully initialized. As a result, the tag.stypeenv field is not...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.18 contains security vulnerabilities. These vulnerabilities stem from the fact that the tcpwritecollapsefence function does not take effect when skwritequeue is empty. This may lead to the merging of skb packets across device encryption boundaries during retransmission ...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.6 contains a security vulnerability. This vulnerability arises from the fact that streamconfig is not initialized before being passed to sdwstreamaddslave. As a result, the type field may contain invalid values, which are then copied to stream-type by sdwconfigstream...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.11 contains security vulnerabilities. These vulnerabilities stem from the wifi cw1200 driver, where the TX path alignment fills the transmission length without reserving space for the padding, and the padding bytes are not cleared. This leads to an out-of-bounds read in...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.12 contains security vulnerabilities. These vulnerabilities stem from the netfsreadgaps function, which does not clear the read gaps surrounding the streaming write to the dirty area. As a result, short reads on the server side or EOF responses may retain outdatedfolio...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.32 contains security vulnerabilities. These vulnerabilities stem from the fact that the fields invalidHandle, swapfile, oplockbreakcancelled, offload, and statusfiledeleted in the cifsFileInfo structure share the same byte. When different code paths concurrently updat...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains a security vulnerability. This vulnerability stems from the data reading function of the rohm-bm1390 driver, which ignores incorrect cached values and returns 0. After the measurement stops, the cached ret value is not returned, potentially leading to the...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.15 contains a security vulnerability. This vulnerability stems from the fact that typecpartnerdesc is not initialized in tps6598xconnect. As a result, uninitialized function pointers may be called, and stack data may be leaked through the partner sysfs...

CVE-2026-110889

The Gantry 5 Framework WordPress plugin (versions

CVE-2026-110889 WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4...

CVE-2026-110889 WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4...

CVE-2026-106470

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 M365 credential belonging to ConnectWise Cloud Backup formerly SkyKick to gain unauthorized access to customers' M365 environments. ConnectWise Clo...

WordPress WP Data Access plugin < 5.5.88 - Subscriber+ SSRF vulnerability

Subscriber+ SSRF vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions 5.5.88...

CVE-2026-106470 WP Data Access < 5.5.88 - Subscriber+ SSRF

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

EUVD-2026-103256

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

CVE-2026-106470 WP Data Access < 5.5.88 - Subscriber+ SSRF

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...