9145 matches found
CVE-2026-88824: Improper Neutralization of Input During Web Page Generation
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...
PT-2026-95760
Name of the Vulnerable Software and Affected Versions Master Blocks versions prior to 1.5.0 Description An authorization flaw exists in a REST route that allows unauthenticated users to update plugin settings. This includes the ability to modify a value that is output unescaped in the...
CVE-2026-85410
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
CVE-2026-85410 Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
EUVD-2026-82793
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
CVE-2026-85410
The Master Addons for Elementor WordPress plugin is vulnerable to an authorization bypass in versions up to and including 3.2.2 . The plugin fails to properly verify user permissions, and the jltma_popup custom post type is registered with capability_type='post', making its admin edit screen acce...
CVE-2026-85410 Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
CVE-2026-85410: Missing Authorization
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
Linux Distros Unpatched Vulnerability : CVE-2026-93200
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i3c: master: Fix use-after-free of master-this sysfs attribute callbacks for the master controller device dereference master-this. However, master-this is freed...
PT-2026-95334
Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.2.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level acce...
DEBIAN-CVE-2026-93200
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master-this sysfs attribute callbacks for the master controller device dereference master-this. However, master-this is freed in i3cmasterdetachfreedevs before the master device itself is...
DEBIAN-CVE-2026-93202
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix recursive locking during device registration i3cmasterregisternewi3cdevs registers newly discovered devices while holding i3cbusnormaluselock, a downread. deviceregister can immediately probe the device, and prob...
AZL-102198 CVE-2026-93200 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master-this sysfs attribute callbacks for the master controller device dereference master-this. However, master-this is freed in i3cmasterdetachfreedevs before the master device itself is...
DEBIAN-CVE-2026-93199
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Do not treat master device as a duplicate target i3cmastersearchi3cdevduplicate searches the bus for another I3C device with the same PID as the reference device. The search can match master-this, causing the...
AZL-101906 CVE-2026-93202 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix recursive locking during device registration i3cmasterregisternewi3cdevs registers newly discovered devices while holding i3cbusnormaluselock, a downread. deviceregister can immediately probe the device, and prob...
CVE-2026-93200
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master-this sysfs attribute callbacks for the master controller device dereference master-this. However, master-this is freed in i3cmasterdetachfreedevs before the master device itself is...
CVE-2026-93199
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Do not treat master device as a duplicate target i3cmastersearchi3cdevduplicate searches the bus for another I3C device with the same PID as the reference device. The search can match master-this, causing the...
CVE-2026-93202
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix recursive locking during device registration i3cmasterregisternewi3cdevs registers newly discovered devices while holding i3cbusnormaluselock, a downread. deviceregister can immediately probe the device, and prob...
DEBIAN-CVE-2026-90386
In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...
AZL-102134 CVE-2026-90386 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...