29686 matches found
CVE-2026-76427: Improper Restriction of XML External Entity Reference
A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...
PT-2026-93830
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an...
Linux Distros Unpatched Vulnerability : CVE-2026-89935
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: light: apds9306: fix PM reference leak in apds9306readdata apds9306readdata calls pmruntimeresumeandget but several error paths return directly without...
PT-2026-93526
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtk-mdp3 platform media component regarding SCP device reference counting. The mdp probe function attempts to obtain an SCP handle using scp get. If this fails, it...
Linux Distros Unpatched Vulnerability : CVE-2026-89872
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink In v4l2fwnodeparselink, the remote endpoint fwnode reference is acquired using...
PT-2026-93585
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ASOC hdac hda component. The hdac hda dev probe function acquires an HDA link using snd hdac ext bus link get before registering the ASoC component. ...
Linux Distros Unpatched Vulnerability : CVE-2026-89939
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable atlasbufferpostenable acquires a runtime PM reference with pmruntimeresumeandget but...
PT-2026-93274
Name of the Vulnerable Software and Affected Versions Bookly versions prior to 28.2 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate customer conversations by incrementing the conversation id...
CVE-2026-89935: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: iio: light: apds9306: fix PM reference leak in apds9306readdata apds9306readdata calls pmruntimeresumeandget but several error paths return directly without calling pmruntimeputautosuspend, leaking the runtime PM reference and...
CVE-2026-89939: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable atlasbufferpostenable acquires a runtime PM reference with pmruntimeresumeandget but returns the result of atlassetinterrupt directly. If atlassetinterrupt...
PT-2026-93580
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A power management PM reference leak occurs in the atlas buffer postenable function. The function acquires a runtime PM reference using pm runtime resume and get, but if the subsequent...
CVE-2026-89982: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...
PT-2026-93576
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A power management PM reference leak exists in the apds9306 read data function. The function calls pm runtime resume and get, but certain error paths return without calling pm runtime pu...
CVE-2026-89889: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: media: i2c: imx415: Release runtime PM reference on VBLANK error The VBLANK path returned immediately when programming VMAX failed after pmruntimegetifinuse had taken a runtime PM reference. Break out of the switch instead so the...
WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Insecure Direct Object Reference vulnerability
Insecure Direct Object Reference vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...
CVE-2026-89936: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...
Linux Distros Unpatched Vulnerability : CVE-2026-89934
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: light: ltrf216a: fix runtime PM reference leak in error path ltrf216agetlux acquires a runtime PM reference by calling ltrf216asetpowerstatedata, true...
CVE-2026-89063: Authorization Bypass Through User-Controlled Key
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversationid' parameter due to missing validation on a user controlled key. This makes it possible for...
SUSE CVE-2026-89707
In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...
