13516 matches found
CVE-2026-93456 django-page-cms through 2.0.13 CSRF via admin mutation views
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...
SUSE CVE-2026-90134
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmaplocalpage usage in compress Several compressed I/O paths discard the address returned by kmaplocalpage and later access or unmap the page using pageaddress. This is invalid for highmem pages, and local mappings must...
CVE-2026-93456: Cross-Site Request Forgery (CSRF)
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...
PT-2026-95218
Name of the Vulnerable Software and Affected Versions django-page-cms versions prior to 2.0.14 Description Five admin mutation views in pages/admin/views.py are exempt from Cross-Site Request Forgery CSRF protection. This allows attackers to forge requests that modify page content. Signed-in...
EUVD-2026-82425
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
GHSA-4RF6-QX84-Q9FV Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The...
SUSE CVE-2026-89808
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...
SUSE CVE-2026-89931
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Ensure KVMREQGETNESTEDSTATEPAGES is cleared on VM-Exit Always check and clear KVMREQGETNESTEDSTATEPAGES when emulating a nested VM-Exit to ensure the request is cleared, even when KVM was built with CONFIGKVMHYPERV=n, ...
EUVD-2026-81727
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmaplocalpage usage in compress Several compressed I/O paths discard the address returned by kmaplocalpage and later access or unmap the page using pageaddress. This is invalid for highmem pages, and local mappings must...
PT-2026-94864
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the x86 memory management PAT Page Attribute Table implementation. The problem occurs when loading and unloading modules concurrently on multiple CPUs...
PT-2026-94782
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the zisofs fill pages function where the compressed block pointer table is read. While error paths and loop advancements correctly release the buffer head, the success...
PT-2026-94766
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel BUG occurs within the nilfs copy dirty pages function, which is responsible for copying dirty DAT file folios or pages to the shadow page cache. The issue is triggered when a...
PT-2026-94843
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf arena free pages function where scalar arena addresses are processed by masking the address to the low 32 bits and reconstructing a full user address from the...
PT-2026-94482
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Compressed I/O paths in the NTFS driver incorrectly handle memory mapping by discarding the address returned by the kmap local page function and subsequently accessing or unmapping the...
PT-2026-99524
TuxCare rebuilt drupal/protected pages to address 1 CVE. Fixed in 7.2.4-p1+tuxcare...
CVE-2026-89908 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...
CVE-2026-89908 LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...
EUVD-2026-80508
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...
EUVD-2026-80200
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...
