CVE-2026-82519

The Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check in the profile-page update handler. An authenticated low-privileged attacker can submit a crafted POST request omitting the two-factor-authentication field, which skips nonce verification and trigg...

CVE-2026-82519 Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

Astra Linux – Vulnerability in cyrus-sasl2

In Cyrus SASL 2.1.17 through 2.1.27 up to 2.1.28, the plugins/sql.c file does not escape the password used in SQL INSERT or UPDATE statements...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix crash while reading debugfs attribute The qedidbgdonotrecovercmdread function invokes sprintf directly on a user pointer, which results into the crash. To fix this issue, use a small local stack buffer for sprintf...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ppdev: An error check was added in registerdevice. In registerdevice, the return value of idasimpleget is unchecked. In this case, idasimpleget will use an invalid index value. To address this issue, the index should be checked...

Astra Linux – Vulnerability in libsdl1.2

It was discovered that SDL v1.2 contains a use-after-free issue due to the XFree function in the file /src/video/x11/SDLx11yuv.c...

Astra Linux – Vulnerability found in libsdl1.2, libsdl2, and sdl-image1.2

In SDL Simple DirectMediaLayer, versions from 1.2.15 up to 2.x, and then from 2.0.9 onwards, there is a heap-based buffer over-read issue in the BlitNtoN function within the video/SDLblitN.c file, when it is called from the SDLSoftBlit function in the video/SDLblit.c file...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fixed an off-by-one buffer overflow in alarmsstore. The sysfs buffer passed to alarmsstore is allocated with ‘size + 1’ bytes, and a NUL terminator is appended. However, the ‘size’ argument does not account for this...

Astra Linux – Vulnerability in net-snmp

Net-SNMP provides various tools related to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials could exploit an improper input validation vulnerability when setting malformed OIDs in both the master agent and subagent simultaneously. Version 5.9.2...

Astra Linux – Vulnerability in libsdl2

In SDL Simple DirectMediaLayer versions 2.x through 2.0.9, there is a heap-based buffer over-read issue in the FillIMAADPCMblock function, caused by an integer overflow in the IMAADPCMDecode function in the audio/SDLwave.c file...

Astra Linux – Vulnerability in libpgjava

pgjdbc, the PostgreSQL JDBC Driver, allows attackers to inject SQL statements if the PreferQueryMode=SIMPLE setting is used. Note that this is not the default setting. In the default mode, there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus sign...

Astra Linux – Vulnerability in libsdl2

SDL Simple DirectMedia Layer version 2.0.12 has a heap-based buffer over-read issue in the function Blit3or4to3or4inversedrgb in the file video/SDLblitN.c, caused by a malicious .BMP file...

Astra Linux – Vulnerability in binutils

A issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. The simpleobjectelfmatch function in simple-object-elf.c does not check for a zero value of shstrndx, resulting in an integer overflow and a heap-based buffer overflow...

Astra Linux – Vulnerability in libsdl1.2

SDL Simple DirectMediaLayer from version 1.2.15 to 2.x, and from 2.0.9 to 2.0.9, has a heap-based buffer overflow issue in the SDLFillRect function within the video/SDLsurface.c file...

Astra Linux – Vulnerability in libsdl1.2, libsdl2

In SDL Simple DirectMedia Layer, from versions 1.2.15 onward, as well as in versions 2.x through 2.0.9, there is a heap-based buffer over-read issue in the Map1toN function within the video/SDLpixels.c file...

WordPress Simple Membership plugin < 4.7.8 - Subscriber+ Membership Level Escalation vulnerability

Subscriber+ Membership Level Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin Simple Membership versions 4.7.8...

PT-2026-91411

Name of the Vulnerable Software and Affected Versions Really Simple Security plugin for WordPress versions prior to 9.8.2 Description An authorization check is missing in the profile-page update handler, allowing authenticated low-privileged attackers to bypass enforced two-factor authentication...

CVE-2026-82519: Missing Authorization

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2026-89080

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

CVE-2026-88764

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...