CVE-2026-67921

creationtimestamp| type| source ---|---|--- 2026-08-10 08:46:15+00:00| seen| https://gist.github.com/unpredictable21/01b053bcf8bb5a3c557df92f5c2c3c30...

MINI-W259-HJR8-WP97

Bulletin has no description...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Added a call to putpid. Added a call to putpid corresponding to gettaskpid. host1xmemorycontextalloc does not take ownership of the PID, so we need to free it here to avoid leaks. [email protected]: reword commit...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP – Fixed issue where multiple L2CAPECREDCONNREQUESTs were accepted. Currently, the code attempts to accept requests regardless of the command identifier. This can result in multiple requests being marked as pendin...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fixed out-of-bound access in fib6addrt2node. syzbot reported an out-of-bound read in fib6addrt2node. 0 When an IPv6 route is created with RTANHID, the struct fib6info does not have the trailing struct fib6nh. The referenced...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdkfd: Fixed the bounds checking of watchid in debug address watch v2. The address watch clear code receives watchid as an unsigned value u32, but some helper functions used a signed int and checked the bits by shifting...

EUVD-2026-54999

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

CVE-2026-17022

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyi...

CVE-2026-19053

CVE-2026-19053 affects the ProSolution WP Client WordPress plugin prior to 2.0.6. The root cause is improper sanitization/escaping of a parameter (reported as the jobID parameter) before it is used in a SQL statement, which is reachable by unauthenticated visitors. This leads to a blind SQL injec...

CVE-2026-19053 ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection...

EUVD-2026-55016

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

CVE-2026-15238

CVE-2026-15238 affects the MotoPress Hotel Booking WordPress plugin (before 6.2.3). The vulnerability arises because the plugin does not verify record ownership when updating customer records, enabling any authenticated user with a low-privilege account (Subscriber and above) to modify or overwri...

DEBIAN-CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-19382

creationtimestamp| type| source ---|---|--- 2026-08-10 02:49:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5tt34kegco3un...

CVE-2026-19381

creationtimestamp| type| source ---|---|--- 2026-08-10 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/117068623277375334 2026-08-10 01:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msoxaf46yl2v 2026-08-10 02:00:02+00:00| seen|...

CVE-2026-19376

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been...

MINI-J4WQ-CP5R-CCW7

Bulletin has no description...

MINI-223J-789F-2V9H

Bulletin has no description...

MINI-XQ7F-G2C6-95HC

Bulletin has no description...

CVE-2026-56793

creationtimestamp| type| source ---|---|--- 2026-08-09 15:04:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117066162544319010 2026-08-09 15:04:41+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msnubd3w252d...