CVE-2024-26839

CVE-2024-26839 affects the Linux kernel: a memleak in IB/hfi1’s init_credit_return when dma_alloc_coherent fails to allocate dd->cr_base[i].va; proper cleanup should deallocate dd->cr_base and any previously allocated dd->cr_base[i] to avoid leaks. The issue is resolved by the kernel fix...

CVE-2024-26836

In CVE-2024-26836, the Linux kernel flaw lies in platform/x86 think-lmi where the password opcode ordering must occur before changing the attribute value for Lenovo workstations with Admin password enabled. The fix adjusts this order to address the issue (tested on some ThinkPads). The vulnerabil...

CVE-2024-26833

CVE-2024-26833 : In the Linux kernel, the drm/amd/display memory-leak issue was caused by not freeing memory for dmub_srv after its destruction. The backtrace implicates dmub_sw_init and related AMDGPU initialization paths, with an unfreed object after dmub_srv destruction. The advisory’s fix is ...

CVE-2024-26832

CVE-2024-26832 affects the Linux kernel mm: zswap writeback path. The fix unlocks and releases the folio obtained from __read_swap_cache_async() before returning, preventing a potential folio from being stranded. Connected advisories confirm a patch in kernel releases (e.g., Linux kernel 6.1.82 i...

CVE-2024-32510

CVE-2024-32510 is a reflected XSS in WP Cost Estimation & Payment Forms Builder (WordPress). It arises from improper input neutralization during web page generation, allowing reflected script execution. Affected: WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75. CVSS v3.1 base...

CVE-2024-32526

CVE-2024-32526 : In Easy Textillate (WordPress plugin), stored XSS exists due to improper input neutralization during web page generation, affecting versions

CVE-2024-32528

CVE-2024-32528 affects the WP Dynamic Keywords Injector (WordPress plugin) and is a reflected XSS due to improper input neutralization during page generation. Affected versions: n/a through 2.3.18. CVSSv3.1 base score 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Connected records indicate the issue...

CVE-2024-26824

CVE-2024-26824 affects the Linux kernel crypto/algif_hash: hashing a zero-length message could trigger a faulty SG list free on error. The fix removes freeing the SG list on the zero-length error path; kernel updates implementing this change are the remediation.

CVE-2024-26821

CVE-2024-26821 is explicitly rejected by its CNA and is not a valid vulnerability entry.

CVE-2024-26820

CVE-2024-26820 affects the Linux kernel hv_netvsc driver. The issue occurs when the hv_netvsc module is unloaded and reloaded: the NET_DEVICE_REGISTER handler can fail to register a VF because the VF registration call arrives before netvsc_probe finishes, since register_netdevice_notifier() is re...

CVE-2024-26818

CVE-2024-26818 affects the Linux kernel (rtla/ utils.c) where a fscanf call uses mount_point with a size of MAX_PATH but the format can write up to MAX_PATH+1, risking a buffer overflow. The connected Astra/Tencent/Tenable data confirms the root cause and documents the fix: increase the mount_poi...

CVE-2023-52642

CVE-2023-52642 concerns a Linux kernel issue in the media: rc subsystem where attaching/detaching BPF programs could require write permission, with an auxiliary CAP_NET_ADMIN requirement. The main impact described across multiple advisories is a locally exploitable condition in kernel space that ...

CVE-2024-32531

CVE-2024-32531 affects the GuCherry Blog WordPress theme (GuCherry Blog) with a Reflected XSS vulnerability in web page generation. The issue affects GuCherry Blog versions from n/a up to and including 1.1.8. The connected Wordfence entry explicitly notes Reflected XSS with Unpatched status; no r...

CVE-2023-44227

CVE-2023-44227 affects WordPress plugin Simple File List (Mitchell Bennis) up to version 6.1.9. Root cause: Missing/insufficient authorization controls allow unauthenticated users to delete arbitrary files via the plugin’s deletion functionality, enabling potential denial of service or data loss....

CVE-2023-36505

CVE-2023-36505 affects the Ninja Forms Contact Form WordPress plugin (versions

CVE-2023-25043

CVE-2023-25043 relates to WordPress Data Tables Generator by Supsystic (plugin) versions = 1.10.26. Monitoring recommended for any updates from vendor/security feeds. The connected Patchstack entry confirms the vulnerability details and the fixed version.

CVE-2024-32533

CVE-2024-32533 affects LH Add Media From Url for WordPress (

CVE-2024-24856

CVE-2024-24856 concerns a Linux kernel ACPI issue where ACPI_ALLOCATE_ZEROED may return NULL and the code dereferences it without checking. The vulnerability leads to a NULL pointer dereference in the ACPI subsystem (notably in modules such as Linux kernel’s ACPI handling). The documented remedia...

CVE-2024-32539

Technical details about CVE-2024-32539 are not provided in the connected documents. Public information here is limited to the basic description; monitor for updates.

CVE-2024-32544

CVE-2024-32544 (Netgsm WordPress Plugin) is a Reflected XSS vulnerability affecting Netgsm for WordPress up to version 2.8. The Netgsm plugin’s input is improperly neutralized during web page generation, enabling a reflected cross-site scripting attack. The connected sources list this as a fixed ...