13521 matches found
CVE-2026-63813
Summary: CVE-2026-63813 relates to the Linux kernel and a revert of a previous f2fs change in move_data_block that could cause page-cache/folio handling race conditions. The embedded details describe a race where the GC path can evict the tail-end folio from the page cache, drop page-cache refere...
CVE-2026-53372
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Kernel lacks dirty tracking support on nested domain attached to PASID, fails the attachment early if nesting parent domain is dirty tracking configured,...
PT-2026-61473
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs and afs components where write operations for directories and links could be skipped due to lock contention and the use of WB SYNC NONE. This occurs within t...
CVE-2026-63879: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...
CVE-2026-64104: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...
PT-2026-61448
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management subsystem where spurious warnings occur when unmapping device-private or exclusive pages. The system incorrectly uses the vma is anonymous functi...
CVE-2026-62386
The CVE-2026-62386 entry applies to Grav API plugin (getgrav/grav-plugin-api)
CVE-2026-62386
The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...
PT-2026-60650
Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16 Description The plugin accepts JWT JSON Web Token access tokens via the token URL query parameter on every API route through the JwtAuthenticator::extractBearerToken fallback. This behavior causes...
Oracle Linux 10 : libsolv (ELSA-2026-28236)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-28236 advisory. - Fix a buffer overflow when decompressing solv pages CVE-2026-48864 RHEL-178270 - Cope with integer overflow in data size arithmetics in repoaddsolv...
CVE-2026-44176 Kirby: `pages.access` permission is not checked during rendering of page drafts
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the pages.access permission during page draft rendering. Permissions are defined for each user role in the user blueprint site/blueprints/users/.... It is also possible to customize the permissions f...
CVE-2026-44176 Kirby: `pages.access` permission is not checked during rendering of page drafts
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the pages.access permission during page draft rendering. Permissions are defined for each user role in the user blueprint site/blueprints/users/.... It is also possible to customize the permissions f...
CVE-2026-44176 Kirby: `pages.access` permission is not checked during rendering of page drafts
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the pages.access permission during page draft rendering. Permissions are defined for each user role in the user blueprint site/blueprints/users/.... It is also possible to customize the permissions f...
CVE-2026-13767
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsmajaxsavepages AJAX handler sanitizetextfield only and lack o...
CVE-2026-13767 Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsmajaxsavepages AJAX handler sanitizetextfield only and lack o...
CVE-2026-13767
CVE-2026-13767 affects the Quiz Master Next WordPress plugin up to version 11.2.0. The issue is a stored SQL injection in the quiz page data via the ‘pages’ parameter, persisted by qsm_ajax_save_pages() and interpolated into an IN() clause in qsm_options_questions_tab_content() without proper pre...
CVE-2026-12409: Cross-Site Request Forgery (CSRF)
The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...
libsolv security update
0.7.33-5 - Fix a buffer overflow when decompressing solv pages CVE-2026-48864 RHEL-178270 0.7.33-4 - Cope with integer overflow in data size arithmetics in repoaddsolv CVE-2026-9149 RHEL-178267 0.7.33-3 - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository CVE-2026-91...