CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89526

A vulnerability in the Linux kernel's svcrdma (NFS/RDMA server) component allows a remote attacker to craft an RPC/RDMA Read chunk position field that bypasses validation. In the single-chunk path, a position past the inline body underflows the tail length, exposing adjacent slab memory to the up...

CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89444 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89444 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-62137

Unauthenticated Sensitive Data Exposure in bbPress = 2.6.14 versions...

WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin bbPress versions = 2.6.14...

CVE-2026-62088

The ElasticPress WordPress plugin (by 10up), versions through 5.3.4 , is affected by a Sensitive Data Exposure vulnerability classified as Insertion of Sensitive Information Into Sent Data. An unauthenticated remote attacker can retrieve embedded sensitive data, with a CVSS v3.1 score of 5.3 (Med...

CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...

WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by murloc.mrglwglwgl in WordPress Plugin ElasticPress versions = 5.3.4...

CVE-2026-62137 WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in bbPress = 2.6.14 versions...

EUVD-2026-76200

Unauthenticated Sensitive Data Exposure in bbPress = 2.6.14 versions...

CVE-2026-62137

An unauthenticated Sensitive Data Exposure vulnerability affects the WordPress bbPress plugin in versions 2.6.14 and earlier , as discovered by Ananda Dhakal via Patchstack . The flaw allows a remote attacker with no prior access to expose sensitive data, carrying a CVSS 3.1 score of 5.3 (Medium)...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-89012

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

vibe-coding-security

Vibe Coding Security Before you tweet your launch, run these 69 checks. They map to the exact patterns behind the Lovable RLS CVE CVE-2025-48757, 170+ apps, 2025, the Moltbook leak 1.5M API tokens, Feb 2026, and the April 2026 Lovable platform breach source code + service keys of other users'...

EUVD-2026-76141

Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the...