CVE-2026-64404

In the Linux kernel, the following vulnerability has been resolved: B...

CVE-2026-64326

In the Linux kernel, the following vulnerability has been resolved: b...

EUVD-2026-48870

In the Linux kernel, the following vulnerability has been resolved: block: skip syncblockdev on surprise removal in bdevmarkdead bdevmarkdead's @surprise == true means the device is already gone. The filesystem callback fsbdevmarkdead honours this and skips syncfilesystem, but the bare block devi...

WordPress Videos sync PDF <=1.7.4 - Local File Inclusion

WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. id: CVE-2022-1392 info: name: WordPress Videos sync PDF =1.7.5 or apply the vendor-provided patch to mitigate the vulnerability. reference...

CData Sync < 23.4.8843 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Sync CData - Sync' - raw...

QNAP HBS 3 - Broken Access Control

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...

Post Sync Plugin <= 1.1 - Cross-Site Scripting

Post Sync WordPress plugin = 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a maliciou...

FineCMS <5.0.9 - Open Redirect

FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...

WordPress VR Calendar <=2.3.2 - Remote Code Execution

WordPress VR Calendar plugin through 2.3.2 is susceptible to remote code execution. The plugin allows any user to execute arbitrary PHP functions on the site. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without...

DEBIAN-CVE-2026-64248

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

EUVD-2026-46635

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduc...

EUVD-2026-46771

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Siebel Server Sync for Exchange. Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM...

CVE-2026-63977

A flaw was found in the Linux kernel's dpll: zl3073x module. A race condition can occur during device teardown when a changework operation is re-scheduled after a cancelworksync call. This can lead to the system attempting to access a memory location that has been freed or is invalid, potentially...

CVE-2026-65314

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduc...

CVE-2026-60357

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Siebel Server Sync for Exchange. Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM...

CVE-2026-65314 Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduc...

CVE-2026-65314 Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduc...

GHSA-VRHC-JJFC-M3M3 Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account IsActive=false when the user signs in through an authentication source that does not issue refresh tokens notably GitHub, and any OIDC/OAuth2 source configured without offlineaccess. PR 38009 added a gate intended ...

CVE-2026-63729 TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File

The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...