CVE-2026-90770

creationtimestamp| type| source ---|---|--- 2026-09-13 11:46:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ehr4tttpuqdpm 2026-09-13 12:02:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfkgnabxv2b 2026-09-15 04:50:05+00:00| seen|...

CVE-2026-88764 Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...

CVE-2026-36453

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables...

CVE-2026-36453

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables...

EUVD-2026-77109

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables...

SUSE CVE-2026-89447

In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...

SUSE CVE-2026-89473

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...

SUSE CVE-2026-89512

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

SUSE CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

SUSE CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

SUSE CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...

SUSE CVE-2026-89697

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89646

A flaw was found in the Ceph filesystem component of the Linux kernel. When a writeback operation is aborted during an unmount process, a reference to an inode a data structure describing a filesystem object is not properly released. This prevents the inode from being evicted, potentially leading...

Ruby: Remote code execution

Background Ruby is an interpreted scripting language for quick and easy object-oriented programming. Description A vulnerability has been discovered in Ruby. Please review the CVE identifier referenced below for details. Impact Remote code execution is possible. Workaround There is no known...

Linux Distros Unpatched Vulnerability : CVE-2026-89683

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZ...

Linux Distros Unpatched Vulnerability : CVE-2026-89737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: thunderbolt: Disable work before freeing tbt on remove tbtaltmoderemove drops the plug and cable references without draining tbt-work. The work...

Linux Distros Unpatched Vulnerability : CVE-2026-89680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix nfsdfile leak on inter-server COPY setup failure When nfsd4setupinterssc fails, nfsd4copy returns nfserroffloaddenied directly, bypassing the out: lab...

Linux Distros Unpatched Vulnerability : CVE-2026-89446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommufd: Release current IOAS on xastore failure iommufdtakealliovarwsem takes an object reference and the iovarwsem write lock before storing the IOAS in the...

Linux Distros Unpatched Vulnerability : CVE-2026-89645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding...

Linux Distros Unpatched Vulnerability : CVE-2026-89453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with it...