SUSE CVE-2026-80530

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-80530

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

UBUNTU-CVE-2026-80530

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-80530

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-80530 xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-80530 xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-80530

This vulnerability affects the XFS filesystem in the Linux kernel. When exchanging two full-file ranges with the XFS_EXCHMAPS_INO1_WRITTEN flag, xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings from file1, causing the post-operation cleanup to clear the reflink flag from an in...

CVE-2026-77695

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

EUVD-2026-66285

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

CVE-2026-77695 Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

CVE-2026-77695

CVE-2026-77695 affects the Return Refund and Exchange For WooCommerce WordPress plugin in versions prior to 4.6.4 . The root cause is that certain AJAX actions exposed to unauthenticated users do not correctly verify the ownership of guest orders . An unauthenticated attacker can exploit this to ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098977)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098977 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging either...

CVE-2026-78913

creationtimestamp| type| source ---|---|--- 2026-08-25 23:08:40+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117158662638557086 2026-08-26 04:45:59+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-31 04:46:14+00:00| seen|...

CVE-2026-79662 Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass

Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirecturi against the admin-configured allowlist, ignoring path, query, and fragment component...

CVE-2026-63586

creationtimestamp| type| source ---|---|--- 2026-08-25 08:55:44+00:00| seen| https://infosec.exchange/users/certvde/statuses/117155308741154477 2026-08-25 08:55:50+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mtvh4etatnk2 2026-08-25 09:47:22+00:00| seen|...

CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant,...

GHSA-M5R8-W65Q-8WJF Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...