CVE-2026-91015

Master Addons for Elementor WordPress plugin (versions 3.0.0–3.1.8 ) suffers from a missing authorization check on the AJAX action jltma_popup_disable_expired , which is used to deactivate Popup Builder popups. The only protection is a nonce publicly output to every visitor , meaning any unauthen...

CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

WordPress Master Addons for Elementor plugin 3.0.0-3.1.8 - Unauthenticated Popup Deactivation vulnerability

Unauthenticated Popup Deactivation vulnerability discovered by JunHee CHO in WordPress Plugin Master Addons for Elementor versions 3.0.0-3.1.8...

CVE-2026-25589-25588-25243-23631-23479-REDIS

РУКОВОДСТВО ПО ПРОВЕРКЕ И УСТРАНЕНИЮ 5 CVE REDIS ПО СОСТОЯНИЮ НА 08.05.2026 Дата выпуска: 2026-05-08 Автор: TonyCao [email protected] Источник: Redis Security Advisory ОГЛАВЛЕНИЕ 1. Обзор 2. Затронутые версии 3. Детали по каждому CVE CVE-2026-23479 — Use-after-free в Unblock Client Flow...

CVE-2026-92785

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...

CYBERDUDEBIVASH-5G-Core-Key-Rotation-Ghost-Admin-Auditor

CYBERDUDEBIVASH 5G Core Key Rotation & Ghost Admin Auditor v1.1 © 2026 CYBERDUDEBIVASH – Все права защищены Мировой авторитет в области безопасности 5G с нулевым доверием и частных сетей Бхубанешвар, Одиша, Индия Инструмент производственного уровня для обнаружения и устранения CVE-2026-0622...

CVE-2020-11651

CVE-2020-11651 PoC для CVE-2020-11651 Требуется Python3, протестировано на 3.8 python3.8 -m pip install pyzmq msgpack root@kitploit: ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target...

EUVD-2026-80009

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header IP-AH authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i3c: Added a NULL pointer check in i3cmasterqueueibi The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls i3cmasterqueueibi to queue an IBI work task, leading...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i3c: Use i3cdev-desc-info instead of calling i3cdevicegetinfo to avoid deadlock. A deadlock may occur because i3cmasterregister acquires &i3cbus-lock twice. See the log below. Use i3cdev-desc-info instead of calling...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i2c: cadence: cdnsi2cmasterxfer: Fixed a runtime PM leak on the error path. The cdnsi2cmasterxfer function acquires a runtime PM reference when it is executed. This reference is released when the function exits. Currently, there ...

Astra Linux – Vulnerability in ntfs-3g

In NTFS-3G versions before 2021.8.22, when a specially crafted NTFS attribute is provided to the function ntfsgetattributevalue, a heap buffer overflow can occur, allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access, which can be...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted using a single master key provided by the user. There was a flaw in LibreOffice where the master key was poorly encoded, resulting in a reduction in its entro...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

A reachable assertion in FFmpeg’s git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service DoS by opening a crafted AAC file...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: anysee: fixed the null-ptr-deref in anyseemasterxfer. In anyseemasterxfer, msg is controlled by the user. When msgi.buf is null and msgi.len is zero, previous checks on msgi.buf will still be performed. Malicious data will...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Make sure to refresh masterdev/mops in rtnlnewlink. While looking at one unrelated syzbot bug, I found that the replay logic in rtnlnewlink could potentially trigger a use-after-free condition. It’s better to clear...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: mipi-i3c-hci: Fixed a kernel panic when accessing DATdata. The i3cmasterbusinit function may attach the I2C devices before the I3C bus initialization. In this case, the DAT allocentry will be used before the DAT init...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fixed an error where “free initdynaddr” was not executed at i3cmasterputi3caddrs. If dev-boardinfo && dev-boardinfo-initdynaddr ^^^ This check for “initdynaddr” was corrected. i3cbussetaddrslotstatus&master-bus,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: A suspicious RCU usage warning was fixed in iptunnelinitflow. There are code paths where the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning 1. The issue was fixed...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add null pointer check for inode operations This adds a sanity check for the iop pointer of the inode which is returned after reading Root directory MFT record. We should check the iop is valid before trying to create t...