CLSA-2026-1792342448 TuxCare security update for @babel/register (1 CVE)

TuxCare rebuilt @babel/register to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792342442 TuxCare security update for @babel/register (1 CVE)

TuxCare rebuilt @babel/register to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792342443 TuxCare security update for @babel/register (1 CVE)

TuxCare rebuilt @babel/register to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CVE-2026-65660-Poc

MS SharePoint CVE-2026-65660 - Malicious Register Directive Code Injection Exploit Description This repository provides a production-ready exploit for CVE-2026-65660 Improper Control of Generation of Code, CWE-94 in Microsoft SharePoint Server. The vulnerability stems from unescaped quote injecti...

CVE-2026-98654

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-98654

Removed by vendor...

PT-2026-116886

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clk init data and clk parent data The clk init data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drive...

PT-2026-116839

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: unregister net devices in case of probe failure If register netdev fails for one of the MTK MAX DEVS devices in mtk probe, the error path jumps to err deinit ppe, skipping mtk unreg dev. The previously...

PT-2026-117067

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clk hw onecell data with counted by" annotated the hws member of 'struct clk hw onecell data' with counted by, which informs the bounds...

CVE-2026-110135

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and...

CVE-2026-110135 OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and...

EUVD-2026-102696

The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and...

CVE-2026-110135

The OTP Login & Register Woocommerce WordPress plugin, in versions before 2.7.3 , is vulnerable to an unauthenticated account takeover due to a failure in limiting one-time-password (OTP) verification attempts. The root cause is that the plugin tracks the attempt limit against a client-supplied v...

CVE-2026-109447 User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the role parameter handled by the wppbaddmetatouseronactivation function. The vulnerability...

CVE-2026-109447

The User Profile Builder WordPress plugin (versions up to and including 4.0.3 ) is vulnerable to unauthenticated privilege escalation via the role parameter. The flaw exists in the wppb_add_meta_to_user_on_activation() function, which passes attacker-supplied role values directly to WP_User::set_...

PT-2026-115476

Name of the Vulnerable Software and Affected Versions OTP Login & Register Woocommerce WordPress plugin versions prior to 2.7.3 Description An issue exists where one-time-password verification attempts are not adequately limited. The attempt limit is tracked against a value supplied by the client...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Media: edia: dvbdev: fixed a use-after-free issue. In dvbregisterdevice, pdvbdev is set to equal dvbdev, which is freed in several error-handling paths. However, pdvbdev is not set to NULL after dvbdev’s deallocation, resulting i...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mcb: mcb-parse: fixed an error in handling chameleonparsegdd. If mcbdeviceregister returns an error in chameleonparsegdd, the reference count of the bus and device names is exposed. This issue is addressed by calling putdevice to...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Media: ccs – Avoid possible division by zero Calculating the maximum value of M for scaler configuration involves dividing by the value of the MINXOUTPUTSIZE limit register. Although this value is presumably non-zero, the driver...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: omap-dma: fixed the resource leak in error paths caused by dmapool. The dmapool created by dmapoolcreate is not destroyed when dmaasyncdeviceregister or ofdmacontrollerregister fails, resulting in a resource leak in...