EUVD-2026-59555

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74408

The Linux kernel WiFi driver ath9k has a vulnerability (CVE-2026-74408) where ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] with ts.qid being a 4-bit field (0-15) while the txq array supports only ATH9K_NUM_TX_QUEUES (10). A qid of 10 or higher causes an out-of-bounds access. The documente...

CVE-2026-8840

The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...

CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

PT-2026-72873

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc status stop is called from async ctrl.work If a UVC camera has an asynchronous control, uvc status stop may be called from async ctrl.work: uvc ctrl status event work uvc ctrl status event uvc...

PT-2026-72149

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System versions prior to 3.2.37 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can wri...

PT-2026-72844

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath tx edma tasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9K NUM TX QUEUES 10 entries. A qid = 10 causes a...

MINI-HPX3-4PVV-WF6P

Bulletin has no description...

WordPress TLP Food Menu plugin < 6.0.2 - Unauthenticated Reservation Status Modification vulnerability

Unauthenticated Reservation Status Modification vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions 6.0.2...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: crossplane-fips, k8ssandra-client-fips, eksctl, opentofu, gitlab-operator, gitlab-operator-fips, trivy-operator-fips, gogatekeeper, vcluster, kargo, chaos-mesh, ocm-cli, cloudbeat-fips, kubescape-operator-fips, kubescape-server-fips, consul-k8s-fips, k9s-fips,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: helm-operator, cluster-api-helm-controller, chartmuseum, k8sgpt, envoy-gateway, helm-push, helm-docs, linkerd2, zot, kargo, flux-helm-controller, istio, rancher-fleet, trivy-operator, cert-manager-cmctl, helm-set-status, trivy, flux-source-controller, kots, k9s,...

GO-2026-5338 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, newrelic-infrastructure-agent, helm-operator, wolfictl, cluster-api-helm-controller, chartmuseum, k8sgpt, envoy-gateway, helm-push, skaffold, syft, helm, linkerd2, spegel, docker, buildkitd, rancher, zot, kargo, kubescape-operator, kaniko, steampip...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, newrelic-infrastructure-agent, osv-scanner, helm-operator, wolfictl, cluster-api-helm-controller, chartmuseum, k8sgpt, envoy-gateway, helm-push, nerdctl, skaffold, syft, helm, falco-no-driver, spegel, buildkitd, zot, kargo, kubescape-operator,...

GO-2026-5475 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, newrelic-infrastructure-agent, helm-operator, wolfictl, cluster-api-helm-controller, chartmuseum, k8sgpt, envoy-gateway, helm-push, skaffold, syft, helm, linkerd2, spegel, docker, buildkitd, rancher, zot, kargo, kubescape-operator, kaniko, steampip...

GO-2026-5879 vulnerabilities

Vulnerabilities for packages: helm-operator, vcluster, cluster-api-helm-controller, chartmuseum, argocd-image-updater, gitness, helm-push, opentofu, oras, linkerd2, rancher, kargo, kubescape-operator, kyverno, steampipe, xeol, maru, rancher-fleet, teleport, trivy-operator, cert-manager-cmctl,...

GO-2026-5884 vulnerabilities

Vulnerabilities for packages: helm-operator, vcluster, cluster-api-helm-controller, chartmuseum, argocd-image-updater, gitness, helm-push, opentofu, oras, linkerd2, rancher, kargo, kubescape-operator, kyverno, steampipe, xeol, maru, rancher-fleet, teleport, trivy-operator, cert-manager-cmctl,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: k8sgateway, dask-gateway, terraform-provider-pagerduty, osv-scanner, helm-operator, kubernetes-dns-node-cache, gitness, nerdctl, opentofu, telegraf, flux-image-automation-controller, croc, falco-no-driver, kubeflow-katib, terraform, goreleaser, mc,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: mongo-tools, nodetaint, tflint, rclone, regclient, harbor-registry, undock, rancher-system-agent, cis-operator, cluster-api-provider-vsphere, kapp-controller, terraform, emissary, aws-otel-collector, k3d, wgcf, steampipe, oauth2-proxy, nginx-prometheus-exporter, fzf,...

The vulnerability of the Linux operating system’s kernel, related to insufficient checking of the status of shared resources, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to insufficient checks on the status of resources that are shared among users. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-13328

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...