CVE-2026-89842 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...

CVE-2026-89842 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...

CVE-2026-89820 drm/amd/display: fix dc_lock leak on GPU reset error paths

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...

CVE-2026-89820 drm/amd/display: fix dc_lock leak on GPU reset error paths

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...

CVE-2026-89820

CVE-2026-89820 affects the Linux kernel 's drm/amd/display subsystem. On GPU reset, dm_suspend() acquires the dc_lock and defers its release to dm_resume(). If amdgpu_dm_commit_zero_streams() or dm_dmub_hw_init() fails, the error path returns without releasing the lock , causing every subsequent ...

CVE-2026-89813

This vulnerability affects the Linux kernel drm/amdgpu driver. The KIQ ring (like the MES scheduler ring) sets no_scheduler = true and uses a polling fence, causing it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Because its hardware fence value resides in wb (GTT...

CVE-2026-89812

This vulnerability affects the drm/amdgpu driver in the Linux kernel . The MES (Micro Engine Scheduler) scheduler ring uses no_scheduler = true, causing it to be skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Its polling fence hw value resides in wb (GTT) memory that surv...

CVE-2026-89812 drm/amdgpu: force complete the MES ring fences on reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: force complete the MES ring fences on reset The MES scheduler ring has no drm scheduler noscheduler = true, so it is skipped by the force-completion loop in amdgpudevicepreasicreset. It uses a polling fence whose hw...

CVE-2026-82311

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-11387-WooCommerce-SMS-OTP

CVE-2026-11387 SMS Alert ≤ 3.9.5 — escalada de privilegios no autenticada mediante restablecimiento arbitrario de contraseña Una falla crítica de autenticación incorrecta en el plugin de WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery. Cuando la...

CVE-2026-85530

CVE-2026-85530 affects the GiveWP WordPress plugin (versions 4.16.6 through 4.16.8.0 ). The root cause is an inconsistent normalization of a donor's e-mail address between the value stored and the value used for donor lookup, enabling unauthenticated account takeover : an attacker can be resolved...

EUVD-2026-80196

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

CVE-2026-84907

Eventin (aka WP Event Solution ) is a WordPress plugin for event management. Versions 4.1.5 through 4.1.23 are affected by an authorization flaw in the order finalisation endpoint used when the offline (local) payment method is enabled. The endpoint relies on a nonce that is exposed to unauthenti...

CVE-2026-84907 Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

EUVD-2026-80193

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

CVE-2026-84907 Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

WordPress Eventin plugin 4.1.5-4.1.23 - Unauthenticated Order and Attendee Status Reset vulnerability

Unauthenticated Order and Attendee Status Reset vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Event Solution versions 4.1.5-4.1.23...

CVE-2025-54321

CVE-2025-54321 Reset Password Email Bombing Description The reset password function does not implement rate limiting for the target email address. This allows for an Email Bombing attack CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discoverer Yazan...

CVE-2026-14349

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-80094

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...