CVE-2026-25809 PlaciPy Code Execution Allowed Without Assessment Active State Validation

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission...

kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

A flaw null pointer dereference in the Linux kernel NFS functionality was found in the way client does some specific action for existing NFS connection. A client user could use this flaw to crash the server system...

CVE-2026-25809: Improper Authorization

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission...

The vulnerability of the rcutasks_rude_wait_gp() function in the kernel/rcu/tasks.h module of the Linux operating system allows a attacker to trigger a service failure.

The vulnerability of the rcutasksrudewaitgp function in the kernel/rcu/tasks.h module of the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop. Calling maskn0 on any BN instance corrupts the internal state, causing toString, divmod, and other methods to enter an infinite loop, hanging the process indefinitely. PoC javascript const BN = require'bn.js'; // any...

CVE-2026-0555

The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmercewizardactions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the state parameter. Thi...

OSV-2026-209 Use-of-uninitialized-value in ntrip_parse_url

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=482281265 Crash type: Use-of-uninitialized-value Crash state: ntripparseurl FuzzClient.c...

The vulnerability of the veth_pool_store() function in the drivers/net/ethernet/ibm/ibmveth.c module of the Linux kernel’s Ethernet network adapter driver allows a hacker to cause a system failure.

The vulnerability of the vethpoolstore function in the drivers/net/ethernet/ibm/ibmveth.c module of the Ethernet driver for IBM’s Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

German Agencies Warn of Signal Phishing Targeting Politicians, Military, Journalists

Germany's Federal Office for the Protection of the Constitution aka Bundesamt für Verfassungsschutz or BfV and Federal Office for Information Security BSI have issued a joint advisory warning of a malicious cyber campaign undertaken by a likely state-sponsored threat actor that involves carrying...

CVE-2026-0555 Premmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint

The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmercewizardactions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the state parameter. Thi...

CVE-2026-0555

The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the premmerce_wizard_actions AJAX endpoint in all versions up to and including 1.3.20. The root cause is missing capability checks and insufficient input sanitization and output escaping on the state parameter, en...

WordPress plugin Premmerce 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-0555: Improper Neutralization of Input During Web Page Generation

The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmercewizardactions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the state parameter. Thi...

openSUSE 16 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2026:20177-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20177-1 advisory. Update to version 3.5.0: Security issues fixed: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of...

The vulnerability of the rcutorture_one_extend_check() function in the kernel/rcu/rcutorture.c module of the Linux operating system allows a attacker to trigger a service failure.

The vulnerability of the rcutortureoneextendcheck function in the kernel/rcu/rcutorture.c module of the Linux operating system is related to state management errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Exploit for Expression Language Injection in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

ButtF - Backend Misconfiguration & Logic Flaw Exploitation Too...

Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities

A previously undocumented cyber espionage group operating from Asia broke into the networks of at least 70 government and critical infrastructure organizations across 37 countries over the past year, according to new findings from Palo Alto Networks Unit 42. In addition, the hacking crew has been...

The vulnerability of the safexcel_probe_generic() function in the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the safexcelprobegeneric function in the Linux operating system is related to state management errors. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the isert_wait_conn() function in the drivers/infiniband/ulp/isert/ib_isert.c module of the RTRS server and client kernel driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the isertwaitconn function in the drivers/infiniband/ulp/isert/ibisert.c module of the RTRS server and client kernel driver for the Linux operating system is related to state management errors. Exploiting this vulnerability could allow a remote attacker to compromise the...

The vulnerability of the xfrm_state_gcdestroy() function in the net/xfrm/xfrm_state.c module, which is part of the Linux kernel’s networking functions, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the xfrmstategcdestroy function in the net/xfrm/xfrmstate.c module, which is part of the Linux kernel’s networking functions, is related to improper initialization of resources. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality,...