Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables: Unconditionally flushes pending work before the notifier syzbot reports: KASAN: Slab-uaf in nftctxupdate, include/net/netfilter/nftables.h: 1831 KASAN: Slab-uaf in nftcommitrelease,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: s390/idle: Marking archcpuidle as having no instructions. The linux-next commit “cpuidle: tracing: Warning about !rcuiswatching” adds a new warning that affects the archcpuidle function on the s390 architecture. WARNING: For CPU:...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: restore set elements when delete set fails From the abort path, nftmapelemactivate needs to restore refcounters to their original state. Currently, it uses set-ops-walk to iterate over these set elements. The...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: igb: Fixed the use-after-free error during reset. The next descriptor to be watched nexttowatch is cleaned when cleaning the TX ring. Failure to do this can lead to invalid memory accesses. If igbpoll runs while the controller...

CVE-2026-54150: Improper Limitation of a Pathname to a Restricted Directory

next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote treats any value without an HTTP or HTTPS...

WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint vulnerability

Unauthenticated Authentication Bypass via Default 'token' Fallback in REST Migration Endpoint vulnerability discovered by Samuele Santonicola in WordPress Plugin Next-Cart Store to WooCommerce Migration versions = 3.9.8...

CVE-2026-76009

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-76009

The Next-Cart Store to WooCommerce Migration WordPress plugin (versions ≤ 3.9.8) is vulnerable to unauthenticated authentication bypass via the NCWM_Kitconnect::run() function. The REST route /wp-json/next_cart/v1/migration is registered with permission_callback set to __return_true and relies on...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

EUVD-2026-74689

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

PT-2026-88850

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWM Kitconnect::run function. This is due to the plugin registering the /wp-json/next cart/v1/migration REST route with permission callback...

CVE-2026-76009: Improper Authentication

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +1066 more potentially affected by unknown CVE via next (>=16.0.0, <=16.3.2)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: unknown CVE Source advisory:...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +1066 more potentially affected by CVE-2026-75604 via next (>=16.0.0, <=16.3.2)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-75604 Source advisory:...

CVE-2026-86256

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256

wger before 2.6 (affected versions ≤ 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to a user-supplied next GET parameter via HttpResponseRedirect() without validating it with url_ha...