Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fixed the issue with the mlx5pollone function’s update of the curqp. When curqp is not NULL, in order to avoid fetching the QP from the radix tree again, we check if the next CQE QP is identical to the one we already...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tcp: Call skdataready after listener migration When inetcsklistenstop migrates an established child socket from a closing listener to another socket within the same SOREUSEPORT group, the target listener receives a new...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_64808)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202664808 advisory. kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: iouring/poll: fix signed comparison in iopollgetownership CVE-2026-52933...

AZL-104160 CVE-2026-97530 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xxcopymultiplepkt and qla27xxcopyfpinpkt poll rspq-ringptr-signature for RESPONSEPROCESSED 0xDEADDEAD to decide whether the next continuation IOCB has arrive...

EUVD-2026-86657

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

CVE-2026-97530

The Linux kernel contains a vulnerability in the scsi: qla2xxx driver where the functions qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() incorrectly poll for a specific signature (0xDEADDEAD ) to determine if the next continuation IOCB has arrived. Because a continuation IOCB carries raw...

CVE-2026-98004

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

PT-2026-98819

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the EDAC/device sysfs component where the poll msec sysfs store file utilizes the simple strtoul function. Because simple strtoul accepts an unsigned long while the...

WordPress Forminator Forms plugin < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass vulnerability

Unauthenticated Poll Vote Limit Bypass vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.57.2.1...

CVE-2026-85682

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682

The YOP Poll plugin for WordPress (versions up to and including 7.0.10 ) is vulnerable to an Origin Validation Error . The root cause is the plugin transmitting a wp_rest nonce to window.opener via postMessage() using a wildcard targetOrigin . This allows an unauthenticated attacker to steal a RE...

CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

EUVD-2026-85816

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

CVE-2026-85682: Origin Validation Error

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...

PT-2026-97734

Name of the Vulnerable Software and Affected Versions YOP Poll versions prior to 7.0.11 Description The plugin contains an origin validation error where it transmits a wp rest nonce to window.opener using the postMessage function with a wildcard targetOrigin. This allows unauthenticated attackers...

WordPress YOP Poll plugin <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability

Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin YOP Poll versions = 7.0.10...

CVE-2026-87070 Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

CVE-2026-87070 Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

PT-2026-94728

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mt76 rx poll complete function due to a race condition. This occurs when a Station STA has been removed, but the rx status still maintains a pointer ...