29624 matches found
SUSE CVE-2026-97558
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...
SUSE CVE-2026-98093
In the Linux kernel, the following vulnerability has been resolved: ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfree disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hwfree can run without hwparams, and hwparams can be call...
CVE-2026-88789
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CLSA-2026-1790833998 libxml2: Fix of CVE-2026-74860
CVE-2026-74860: drop the extra PyDECREF on each enumeration value string in pythonAttributeDecl, since PyListSetItem already steals that reference...
CVE-2026-88789
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CVE-2026-88789
The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...
CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
EUVD-2026-90762
Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...
CVE-2026-93882
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
CVE-2026-93882
The LearnPress – WordPress LMS Plugin (versions up to and including 4.4.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) in the CourseMaterialTemplate::render_material_items() callback. This function is exposed via the public lp-ajax-handle (load_content_via_ajax) endpoint, which i...
EUVD-2026-90544
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CLEANSTART-2024-NJ43669 null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request)
Security vulnerability affects the heimdal package. A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ Ticket Granting Server - Request...
CVE-2026-91109 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-91109 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 1.6.12.31 . The root cause is a lack of validation on a user-controlled key within the 'complete_group' parameter. Authenticated attackers with subscri...
SUSE CVE-2026-98054
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...
EUVD-2025-209816
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference IDOR in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccbwoocommercepayment AJAX...