CVE-2026-80672

CVE-2026-80672 is a u16 truncation in the Linux kernel's in-kernel NTFS driver, specifically in ntfs_check_restart_area(). The variable ra_len is declared as u16, but the computed length of the $LogFile log client record array can exceed 65535 (e.g., log_clients of 410 yields 65600), causing trun...

CVE-2026-80672 ntfs: fix u16 truncation of restart-area length check

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

EUVD-2026-67465

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-6286

Amelia – Booking for Appointments and Events Calendar (WordPress plugin, versions ≤ 2.2) is vulnerable to unauthenticated stored XSS via customer name fields. The AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. A...

CVE-2026-6286 Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-80590

CVE-2026-80590 is a Linux kernel vulnerability in the IP fragment reassembly code path (inet: frags ). A virtio_net_hdr (via tun/tap or AF_PACKET) can mark an IPv4/IPv6 fragment as GSO; after reassembly the reassembled skb retains this GSO state, and the subsequent call to skb_segment() — which a...

CVE-2026-80590 inet: frags: strip GSO state from fragments before reassembly

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

EUVD-2026-67580

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

CVE-2026-80590

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

CVE-2026-80590 inet: frags: strip GSO state from fragments before reassembly

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite

Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-69152, CVE-2026-59645, CVE-2026-16221, CVE-2026-18446, CVE-2026-14257, CVE-2026-34481, CVE-2026-12802, CVE-2026-13586, CVE-2026-15055, CVE-2026-59639, CVE-2026-59642, CVE-2026-59647,...

Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153)

Summary Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute...

Security Bulletin: Security Vulnerabilities have been found in IBM Sovereign Core

Summary Security Vulnerabilities have been addressed in IBM Sovereign Core Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs...

CVE-2026-76053

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-77365

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

CVE-2026-3129

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-16654

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15798

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18978

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...