PT-2026-104226

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.0 Description An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is...

CVE-2026-104415: Observable Discrepancy

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

CVE-2026-98161

A flaw was found in the Linux kernel's persistent memory pmem subsystem. When processing storage write requests, the driver continues copying data even if a preceding cache flush operation fails, potentially overwriting the error status and reporting success. A local user performing I/O operation...

GO-2026-6542 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana

Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2026-98161

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

AZL-104201 CVE-2026-98161 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

UBUNTU-CVE-2026-98161

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

CVE-2026-98161

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

EUVD-2026-87061

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

CVE-2026-98161 nvdimm: pmem: keep PREFLUSH before data writes

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...

CVE-2026-98161

A flaw exists in the Linux kernel persistent memory (pmem ) subsystem where the pmem_submit_bio() function incorrectly handles REQ_PREFLUSH errors. Specifically, the driver continues to copy bio data even after a preflush failure, potentially overwriting the error with a subsequent successful REQ...

WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.14...

CVE-2026-96568

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.14 . The flaw stems from insufficient input sanitization and output escaping specifically involving the 'phone_number' parameter. This allows unaut...

EUVD-2026-86597

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-98844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pmem submit bio function where a REQ PREFLUSH error is recorded but the process continues to copy bio data. This can lead to the error being overwritten by a...

PT-2026-98401

Name of the Vulnerable Software and Affected Versions Restaurant Menu and Food Ordering versions prior to 2.4.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the...

CVE-2026-98161: Improper Check for Unusual or Exceptional Conditions

In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...