CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94393

MISP versions below 2.5.47 are affected by a cross-event authorization flaw in the editReport function. When creating or editing a report, MISP resolves an existing report by UUID without verifying that the report belongs to the same event. A user with editor access to at least one event can ther...

CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API

Description WordPress does not validate the target post when a comment or note is moved to another post through the REST API in some cases, which could allow users with a role as low as author to attach their own notes to posts they are not allowed to edit...

Linux Distros Unpatched Vulnerability : CVE-2026-93197

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup i...

DEBIAN-CVE-2026-93197

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvecreparentlru splices the child's lists into the parent's and credits the pare...

CVE-2026-93197 memcg: move LRU size accounting on reparenting instead of copying it

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvecreparentlru splices the child's lists into the parent's and credits the pare...

EUVD-2026-82305

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvecreparentlru splices the child's lists into the parent's and credits the pare...

CVE-2026-87829 Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-87829

Checkout Field Manager (Checkout Manager) for WooCommerce (WordPress plugin) versions before 7.9.7 contain an improper authorization flaw in attachment deletion. The plugin fails to properly validate the ownership of an attachment before allowing its deletion, enabling any authenticated user with...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: Added a NULL check in BE reparenting. A NULL check was also added to the dpcmbereparent API, to handle kernel NULL pointer dereferencing errors. This issue occurred during fuzzing tests...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

SummaryThe moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker...

PYSEC-2026-3822 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

Linux Distros Unpatched Vulnerability : CVE-2026-80746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK...

SUSE CVE-2026-80746

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

CVE-2026-80746

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

CVE-2026-80746

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

UBUNTU-CVE-2026-80746

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

EUVD-2026-70350

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix dispccmdssmdpclksrc RCG stall on Eliza EVK Eliza EVK eliza-cqs-evk.dts does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which...

CVE-2026-80746

CVE-2026-80746 affects the Linux kernel 's Qualcomm Display Clock Controller driver (dispcc-eliza ). On the Eliza EVK platform, the Display Clock Controller is enabled even though display is not, and it references parent clocks from DSI PHYs, causing a clock reparenting issue during probe. This r...