CVE-2026-59539

CVE-2026-59539 affects the WordPress plugin Paid Member Subscriptions (versions

CVE-2026-59531

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks = 2.10.0 versions...

MINI-FQ6M-W3G5-W85G

Bulletin has no description...

Vulnerabilities Fixed in SolarWinds Serv-U

SolarWinds has addressed several vulnerabilities in Serv-U. The vulnerabilities in SolarWinds Serv-U primarily involve insecure direct object reference IDOR and broken access control. These vulnerabilities allow attackers with certain privileges—such as domain administrator or group administrator...

CVE-2026-57917 Improper Restriction of XML External Entity Reference in proCertum SmartSign

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity XXE vulnerability is triggered simply by previewing a file in the file...

UBUNTU-CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534

The CVE-2026-64534 issue affects the Linux kernel nvmet-tcp path for NVMe over TCP. A data-digest mismatch could trigger an unconditional nvmet_req_uninit() cleanup, which, if the command arrived via the nvmet_tcp_handle_req_failure() path, results in a refcount underflow and a use-after-free tha...

CVE-2026-64535 nvmet-tcp: Fix potential UAF when ddgst mismatch

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2CDATA PDU during an R2T-based data...

CVE-2026-64534 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534 nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64321

A flaw was found in the NVMe over RDMA nvmetrdma target in the Linux kernel. When a host queue backlog is exceeded during a connection attempt, a reference count kref is not properly released. This oversight can lead to a resource exhaustion vulnerability, potentially allowing a remote attacker t...

CVE-2026-12493 Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin (versions before 1.3.6 ) is vulnerable to an unauthenticated payment bypass . The flaw exists because the plugin fails to verify if an approved external payment record belongs to the specific WooCommerce order being completed,...

CVE-2026-12493 Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

ECHO-3E75-4E47-1525

Bulletin has no description...

freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser

A flaw was found in FreeRDP. A malicious server can exploit a heap use-after-free or double-free vulnerability in the FreeRDP client's RDPEAR authentication-redirection path. This occurs because the RDPEAR NDR parser incorrectly handles pointer reference IDs, leading to the same heap object being...

Malicious Package

Overview @sqlite-frame/nodesql is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-65305

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the DeleteNotificationController::delete method at the GET /notification/delete/id endpoint. This flaw allows any authenticated us...

PT-2026-64859

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the nvmet-tcp module. When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C DATA PDU during an...

PT-2026-65216

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the SMC-R implementation. The function smc cdc rx handler retrieves a connection using a token while holding the conns lock of the link group. After...