CVE-2026-67607

LightFTP 2.3.1 is affected by a race-condition DoS vulnerability where a fresh FTP connection reuses context during an in-progress ABRT cleanup, exposing an unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside MTLock. This can cause pthread_join() to o...

CVE-2026-67607

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between workerthreadcleanup and...

CVE-2026-18157

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157

CVE-2026-18157 concerns the yggdrasil-worker-package-manager. A local attacker with existing system access can exploit an argument injection vulnerability in the APT backend, where specially crafted package names beginning with a hyphen are misinterpreted as apt-get options. Successful exploitati...

EUVD-2026-51380

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157 Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

EUVD-2026-50995

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-14318

Affected product: GiveWP WordPress plugin (before 4.16.3). Vulnerability: The donation-form template setting is not escaped before output into an HTML attribute, enabling stored XSS. Impact (as described): Users with the GiveWP Worker role and above can inject arbitrary web scripts that execute o...

CVE-2026-17824

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

Build Numbers and Versions of Veeam Plug-in for Xenserver

This KB article lists all versions of the Veeam Plug-in for Xenserver and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-in for Xenserver 1 Releases Veeam Plug-in for Xenserver 1.0 Included with Veeam Backup & Replication 13.1 |...

Build Numbers and Versions of Veeam Plug-in for Sangfor aSV

This KB article lists all versions of the Veeam Plug-in for Sangfor aSV and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-in for Sangfor aSV 1 Releases Veeam Plug-in for Sangfor aSV 1.0 Included withVeeam Backup & Replication 13.1 |...

UBUNTU-CVE-2026-50735

pglogicals apply worker does not sufficiently validate the length of...

Build Numbers and Versions of Veeam Plug-in for Verge OS

This KB article lists all versions of the Veeam Plug-in for Verge OS and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-in for Verge OS 1 Releases Veeam Plug-in for Verge OS 1.0 Included with Veeam Backup & Replication 13.1 | 13.1.0.1...

UBUNTU-CVE-2026-50738

A use-after-free condition exists in pglogicals worker signaling code...

Build Numbers and Versions of Veeam Plug-in for Platform9

This KB article lists all versions of the Veeam Plug-in for Platform9 and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-in for Platform9 1 Releases Veeam Plug-in for Platform9 1.0 Included with Veeam Backup & Replication 13.1 |...

DEBIAN-CVE-2026-50738

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a...

DEBIAN-CVE-2026-50735

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogic...