EUVD-2026-64637

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853

The WooCommerce Bookings WordPress plugin before 3.9.0 is affected by an authorization flaw. A specific AJAX action lacks a capability check , and its nonce check can be bypassed by simply omitting the token. This allows any authenticated user with Subscriber-level access or above to create draft...

EUVD-2026-64605

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149

Security Hardener for WordPress (all versions up to and including 2.4.4 ) contains a Missing Authorization flaw in its user-enumeration protection feature. The plugin's secure_user_endpoints() function hooks the rest_endpoints filter and overwrites the permission_callback on both /wp/v2/users and...

CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

CVE-2026-74701

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

CVE-2026-74693

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length presterafwhdrparse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct presterafwheader before decoding the magi...

CVE-2026-74676

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74651

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74646

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

CVE-2026-74620

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

CVE-2026-74602

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rballocatecpubuffer In rballocatecpubuffer, bpage-order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage...

CVE-2026-74733

CVE-2026-74733 is a race condition in the Linux kernel gpio: pca953x driver. The function pca953x_irq_bus_sync_unlock() failed to hold the driver's i2c_lock before calling regmap read/write operations. Because the driver disables regmap's internal locking in favor of its own lock, this omission a...

EUVD-2026-64420

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74718

This vulnerability affects the Linux kernel devlink subsystem. In devlink_nl_reload_doit(), a call to devlink_netns_get() acquires a reference to a network namespace. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOT...

EUVD-2026-64405

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...