CVE-2026-67598

CVE-2026-67598 affects Emlog Pro up to version 2.6.23. The TLS certificate verification is disabled in include/service/ai.php via CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST across sendStream(), sendImageRequest(), send(), and fetchSearchHtml(), with no option to re-enable verification. Thi...

CVE-2026-67977

The CVE-2026-67977 entry describes an integer overflow in the Svc::FileDownlink::SendPartial component of the fprime framework (v4.2.2). This flaw can allow a Denial of Service when processing a crafted input. The affected software is fprime framework version 4.2.2; the vulnerable function is in ...

CVE-2026-54768

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

GHSA-JHH7-832H-F8HV WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...

CVE-2026-66064

goshs is affected by an ACL/Path Traversal vulnerability in the httpserver/handler.go sendFile logic prior to version 2.1.5. The authorization filename was derived from raw req.URL.Path while using a cleaned path for file access, allowing a trailing slash to bypass .goshs ACL-file protection and ...

CVE-2026-66064 goshs has ACL Bypass & Path Traversal

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...

CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbotsendemailtranscriptfree. This makes it possible for unauthenticated attackers to exfiltrate full chat...

CVE-2026-16774 WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

EUVD-2026-49759

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

CVE-2026-16774

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

PT-2026-65450

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs send email AJAX handler. This is due to the wpcs send email function being registered on both wp ajax wpcs send email and wp ajax nopriv wpcs send email with no nonce...

Linux Distros Unpatched Vulnerability : CVE-2026-64548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and...

CVE-2026-10683

In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...

CVE-2026-10683

The CVE-2026-10683 issue affects the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) in target/slave mode. The rx_full interrupt path gates write_requested() when dw-&gt;state != CMD_SEND, and the state is only reset to READY on STOP. START_DET, which would reset state on each (re)START, wa...

EUVD-2026-48993

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

SUSE CVE-2026-64248

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

...

OESA-2026-3157 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A...