CVE-2026-13344

The CVE concerns the Essential Addons for Elementor WordPress plugin: versions before 6.6.10 are vulnerable. The bug is in the Pricing Table widget title; the HTML tag name is not validated before output, enabling Stored XSS via the title for users with Contributor-level access and above. When an...

EUVD-2026-51011

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

CVE-2026-13344 Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

CVE-2026-13345

CVE-2026-13345 affects the WordPress plugin Essential Addons for Elementor prior to version 6.6.10. The vulnerability arises from missing authorization, status, and visibility checks in the plugin’s product-comparison feature when resolving WooCommerce products, allowing unauthenticated users to ...

CVE-2026-64510

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI Non-Volatile Memory NVM Firmware Interface Table NFIT core. Improper error handling during the initialization process can leave a dangling pointer. A local attacker could potentially trigger an ACPI Machine Che...

EUVD-2026-43692

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page...

Security update for xen

This update for xen fixes the following issues: CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. CVE-2026-62426,CVE-2026-62427: sysctl and platform-op...

CVE-2026-64514

A flaw was found in the Linux kernel's userfaultfd mechanism. This vulnerability occurs when the userfaultfdmustwait and userfaultfdhugemustwait functions incorrectly read Page Table Entries PTEs without proper locking during memory operations. This can lead to an undefined state if a page is bei...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

UBUNTU-CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100

Apache Traffic Server HPACK issue: the encoder updates its dynamic table before the header block is confirmed, causing desynchronization with the decoder after a failed encode. This can corrupt subsequent header blocks on a connection. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. ...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-64318

A flaw was found in the Linux kernel's AIX partition handling. A local attacker can provide a specially crafted AIX/IBM partition table on a block device. When the kernel scans this device, the aixpartition function reads an unvalidated ppcount value, causing it to read beyond the allocated buffe...

CVE-2026-64322

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. The udfloadsparablemap function incorrectly validates the length of the sparing table, treating it as a byte count instead of an entry count. This allows a local attacker, by providing a specially crafted UDF image, to...

CVE-2026-15344

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15344 WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15344

The WP Photo Album Plus WordPress plugin is vulnerable to a generic SQL Injection via the 'table' parameter in all versions up to and including 9.2.04.002. The root cause is insufficient escaping of user-provided input and inadequate preparation of the existing SQL query, allowing an authenticate...

EUVD-2026-50109

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...