CVE-2026-68271

CVE-2026-68271 involves the DRM/Nouveau component of the Linux kernel. The issue stems from incorrect error cleanup order in ucopy paths (nouveau_uvmm_vm_bind_ucopy and nouveau_exec_ucopy): cleanup labels were placed in allocation order instead of reverse allocation order. This could cause derefe...

CVE-2026-68182 comedi: comedi_parport: deal with premature interrupt

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: deal with premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the "comediparport" driver, but it do...

EUVD-2026-55283

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: deal with premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the "comediparport" driver, but it do...

CVE-2026-68130

CVE-2026-68130 (ksmbd, Linux kernel) : The vulnerability arises in ntlm_authenticate() where destroy_previous_session() is invoked using a pre-authentication user pointer derived from the client NTLM blob, before NTLMv2 response validation. An attacker could set the NTLM blob username to a victim...

CVE-2026-68118

The CVE-2026-68118 issue affects the Linux kernel TCP stack: the SYN-RECEIVED path tcp_check_req() accepted in-window non-exact RSTs without exact SEG.SEQ match, causing the request to be removed instead of issuing a challenge ACK. The fix enforces RFC 9293/5961 order by applying the RST check be...

CVE-2026-68092

The CVE-2026-68092 issue affects the Linux kernel where the time/jiffies clocksource is used before it is registered during early boot, leaving max_delta_raw at zero and halting time progress. This caused long boot delays (notably on XEN HVM in some cases). The documented fix initializes the jiff...

WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Smart Online Order for Clover versions = 1.6.1...

CVE-2026-17012

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

CVE-2026-17016

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...

EUVD-2026-55027

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...

CVE-2026-17016

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin, version 3.1.0 and below , is vulnerable to a payment bypass due to a lack of validation in its PayPal Data Transfer return handler . When the PayPal Data Transfer feature is enabled, the plugin fails to verify the amo...

CVE-2026-17016 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...

CVE-2026-17016

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...

CVE-2026-17012

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

Exploit for CVE-2026-53787

CVE-2026-53787 - Amasty Order Attributes Unauthenticated File...

PT-2026-69357

Name of the Vulnerable Software and Affected Versions Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin versions prior to 3.1.1 Description The plugin fails to verify if the PayPal account that received a payment matches the merchant's configured account before marking an...

PT-2026-69532

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the emergency thaw worker can deadlock when handling frozen block devices. This occurs because the function do thaw all callback calls bdev thaw while holding the...

CVE-2026-17012: Improper Access Control

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

Ed25519 identity public keys permit universal signature forgery

All published versions of dcrypt-sign before 2.0.0 accepted the Edwards identity as an Ed25519 public key. A signature with R = B and S = 1 then verified for every message because the challenge term multiplied the identity. The implementation also admitted other noncanonical or small-order inputs...

RUSTSEC-2026-0240 Ed25519 identity public keys permit universal signature forgery

All published versions of dcrypt-sign before 2.0.0 accepted the Edwards identity as an Ed25519 public key. A signature with R = B and S = 1 then verified for every message because the challenge term multiplied the identity. The implementation also admitted other noncanonical or small-order inputs...