CVE-2026-63797

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

EUVD-2026-45463

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

CVE-2026-63797 rpmsg: char: Fix use-after-free on probe error path

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

CVE-2026-63797

The CVE-2026-63797 fix addresses a use-after-free in the Linux kernel rpmsg character device path. If rpmsg_chrdev_eptdev_add() fails after rpmsg_chrdev_probe() stores the new eptdev in the default endpoint’s priv pointer, the eptdev may be freed while callbacks still access the stale priv. The p...

EUVD-2026-45518

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

OESA-2026-3058 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

CVE-2026-16204

Technical details for CVE-2026-16204 are not publicly provided in the supplied documents; no concrete affected versions, vulnerable components, or remediation details are available here. Monitor for updates.

CVE-2026-16204 zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This affects the function toolrunscriptexecute of the file claw/services/tools/script.c of the component Telegram-to-AI Tool Execution Flow. Performing a manipulation results in code injection. It is possible to initiate the attac...

PT-2026-61038

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This affects the function tool run script execute of the file claw/services/tools/script.c of the component Telegram-to-AI Tool Execution Flow. Performing a manipulation results in code injection. It is possible to initiate the...

PT-2026-61316

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the ethtool RSS Receive Side Scaling component. The rss prepare get function allocates the indirection table and hash key buffer through rss get data alloc, and...

CVE-2026-57857

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

CVE-2026-57857

The Flow Payment plugin for WordPress (flow.cl) v3.0.8 is affected by a reflected cross-site scripting (XSS) on the WooCommerce checkout page. The vulnerability arises because error_message from an order-cancellation flow is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57–58) w...

CVE-2026-57857 Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

EUVD-2026-45400

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

CVE-2026-57857 Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

CVE-2026-59173

CVE-2026-59173 is an Uncontrolled Resource Consumption (DoS) vulnerability in Apache Traffic Server. Affected: versions 9.0.0–9.1.13 and 10.0.0–10.1.2. Root cause and impact: unresolved resource exhaustion potentially affecting service availability. Remediation: upgrade to 9.1.14 or 10.1.3, which...

CVE-2026-59173 Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue...

CVE-2026-8505

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOKAUTHENABLE configuration is set to False which is the default...

CVE-2026-7667

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header e.g., filename="../../../target/path" , enabling arbitrary file write operations with...