Linux Distros Unpatched Vulnerability : CVE-2026-80853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting...

SUSE CVE-2026-80853

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

CVE-2026-80853

CVE-2026-80853 affects the Linux kernel KVM subsystem on SNP-enabled hosts . When KVM performs {de,en}crypt operations for an SEV or SEV-ES guest, it used a sub-page allocation for its temporary buffer. On SNP platforms, pages written by firmware are temporarily transferred to Firmware ownership ...

CVE-2026-80853 KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

EUVD-2026-71303

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

CVE-2026-80853 KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

PT-2026-85731

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.5-1.1 Description An issue exists in the KVM subsystem when handling SEV or SEV-ES guests on SNP-enabled hosts. When decrypting or encrypting memory via a temporary buffer, the system may use a sub-page...

CVE-2026-43486 arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults

In the Linux kernel, the following vulnerability has been resolved: arm64: contpte: fix setaccessflags no-op check for SMMU/ATS faults contpteptepsetaccessflags compared the gathered ptepget value against the requested entry to detect no-ops. ptepget ORs AF/dirty from all sub-PTEs in the CONT...

CAPIO: Safe Kernel-Bypass of Commodity Devices Using Capabilities

Securing low-latency I/O in commodity systems forces a fundamental trade-off: rely on the kernel's high overhead mediated interface, or bypass it entirely, exposing sensitive hardware resources to userspace and creating new vulnerabilities. This dilemma stems from a hardware granularity mismatch:...

CVE-2024-49503: Improper Neutralization of Input During Web Page Generation

A Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page. This issue affects Container suse/manager/5.0/x8664/server:5.0.2.7.8.1: before...

CVE-2024-43692

The CVE-2024-43692 issue affects Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE (and LX4) where an attacker can directly request a resource sub page to obtain full privileges, effectively bypassing authentication. Affected: MAGLINK LX CONSOLE (versions up to 3.4.2.2.6) and MAGLINK LX4 CONSOL...

PT-2024-30619 · Unknown · Progauge Maglink Lx Console

Name of the Vulnerable Software and Affected Versions: ProGauge MAGLINK LX CONSOLE affected versions not specified Description: An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly. Recommendations: At the moment,...

CVE-2022-0531

The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the subpage parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting...

PT-2022-13243

Name of the Vulnerable Software and Affected Versions Migration, Backup, Staging WordPress plugin versions prior to 0.9.70 Description The issue is related to a reflected Cross-Site Scripting problem. It occurs because the sub page parameter is not properly sanitised and escaped before being...

WordPress and WordPress plugins have cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

CVE-2021-24242

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed subpage parameter of the plugin's Tools, allowing high privilege users to include any local php file...

PT-2021-15785

Name of the Vulnerable Software and Affected Versions The Tutor LMS – eLearning and online course solution WordPress plugin versions prior to 1.8.8 Description A local file inclusion issue affects the plugin, allowing high privilege users to include any local php file through a maliciously...

Privilege Escalation

kvm is vulnerable to privilege escalation. The vulnerability exists as a flaw was found in QEMU-KVM, allowing the guest some control over the index used to access the callback array during sub-page MMIO initialization. A privileged guest user could use this flaw to crash the guest denial of servi...

Infovista VistaPortal SE Cross-Site Scripting Vulnerability (CNVD-2019-07233)

Infovista VistaPortal SE is a Web-based application from Infovista USA. A cross-site scripting vulnerability exists in the SubPagePackages.jsp page in Infovista VistaPortal SE version 5.1 build 51029, which can be exploited by a remote attacker to inject arbitrary web script or HTML with the help...

qemu-kvm security update

1.5.3-141.el74.6 - Fix CVE-2017-5715 1.5.3-141.el74.5 - kvm-vfio-pci-Only-mmap-TARGETPAGESIZE-regions.patch bz1515110 - Resolves: bz1515110 Regression in QEMU handling for sub-page MMIO BARs for vfio-pci devices rhel-7.4.z...