CVE-2026-80870

CVE-2026-80870 affects the Linux kernel component drm/amdkfd (AMD Kernel Fusion Driver). The vulnerability exists in the CRIU restore flow, where userspace-provided object IDs are passed to idr_alloc() without validation in kfd_criu_restore_event() and criu_restore_memory_of_gpu() . If a restored...

CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Validate CRIU-restored IDs before idralloc The KFD CRIU restore flow restores previously saved object IDs from userspace. For event restore: kfdcriurestoreevent - createsignalevent / createotherevent -...

AZL-99510 CVE-2026-80807 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double listaddtail call on bh-bassocbuffers within nilfslookupdirtydatabuffers. Analysis revealed that the root cause was the insertion of...

EUVD-2026-70910

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

PT-2026-85643

In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-reported read length and fix an skb leak fdp nci i2c read takes the next packet length from two device-supplied bytes and never validates it. The value is a u16 used as the i2c master recv count into a...

Linux Distros Unpatched Vulnerability : CVE-2026-80802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: fdp: bound the device-reported read length and fix an skb leak fdpncii2cread takes the next packet length from two device-supplied bytes and never validate...

CVE-2026-85445 MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count

MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resourc...

CVE-2026-85445 MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count

MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resourc...

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE: This vulnerability corresponds to CVE-2026-69086. Summary Four attribute-view read endpoints build a filesystem path from a caller-controlled id/avID and read it without confining the result to the attribute-view storage directory DataDir/storage/av/. On the load file-exists code path there ...

CVE-2025-12737 Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2026-71219 Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...

CVE-2026-78000 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the...

GHSA-P8RW-8QJ3-HF33 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

CVE-2026-66786

Submariner 's certificate-based IPsec authentication mode (IPSecCertAuthMode: true) is vulnerable to ipsec.conf stanza injection via remote-supplied CableName and subnets fields in the Custom Resource Definition. Because these free-form strings are incorporated into the connection configuration w...

DRUPAL-CONTRIB-2026-129

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-19704

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...

SUSE CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

PT-2026-84879

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...