SUSE CVE-2026-56871

reserved but not needed...

SUSE CVE-2026-80816

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...

PT-2026-86382

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

CVE-2026-86112: Authorization Bypass Through User-Controlled Key

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

CVE-2026-86111: Authorization Bypass Through User-Controlled Key

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

CVE-2026-53602

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-80898

creationtimestamp| type| source ---|---|--- 2026-09-04 20:05:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117214564314860727...

CVE-2026-80848

creationtimestamp| type| source ---|---|--- 2026-09-04 19:51:25+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117214510129353453 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

EUVD-2026-71715

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-85663

creationtimestamp| type| source ---|---|--- 2026-09-04 16:08:03+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupdwlh55522 2026-09-04 16:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupe274p6g22...

EUVD-2026-71251

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...

CVE-2026-80816 ALSA: FCP: Use a private URB for the notification endpoint

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...

CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

CVE-2026-78328

creationtimestamp| type| source ---|---|--- 2026-09-04 12:40:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoycvzfvn26 2026-09-04 20:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupsl3nf4r2l 2026-09-04 22:00:51+00:00| seen|...

CVE-2026-75431

creationtimestamp| type| source ---|---|--- 2026-09-04 09:45:00+00:00| seen| https://gist.github.com/unpredictable21/39e6ce22e4bc45b0e553d0fa6a6e4d1c 2026-09-04 18:08:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupko5ze6u2w 2026-09-05 07:02:26+00:00| seen|...

CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-84146

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.8 , contains a vulnerability where it fails to perform required capability or post-status checks. This allows unauthenticated visitors to retrieve sensitive details—including title, price, SKU, description, and sto...

EUVD-2026-70913

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-17517

The Content Views WordPress plugin (versions before 4.5.1.2 ) is vulnerable to an unauthenticated non-public post content disclosure. The root cause is a failure to verify if a requesting user is authorized to read the posts returned by a specific view. This allows unauthenticated attackers to ob...