CVE-2026-116855 WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3...

CVE-2026-118477 KaliFast Project Management Platform ei_git_repo_url OS Command Injection

The eigitrepourl parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker free registration available to execute arbitrary commands on the KaliFast server with www-data privileges...

CVE-2026-6064 Norton, Avast, and AVG local privilege escalation via link following in Data Shredder

Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder...

CVE-2026-115223 Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-110508 Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when bo...

CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...

CVE-2026-103330 Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...

CVE-2026-103313 BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...

CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbusconnection.connstate to DISCONNECTED prior to calling vmbusdisconnect. But vmbusdisconnect calls vmbusinitiateunload, whi...

CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as externalpowerchanged triggered by the TCPM...

CVE-2026-99214 drm/vc4: hdmi: Move packet RAM enable to PM runtime

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4hdmiwriteinfoframe for the audio infoframe. vc4hdmiwriteinfoframe needs Packet...

CVE-2026-99213 vsock: treat TCP_CLOSING as once-established

In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCPCLOSING as once-established Handle the TCPESTABLISHED - TCPCLOSING transition on OPRST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect shou...

CVE-2026-99212 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdmacm destroy an id RDS still owns on route failure rdsrdmacmeventhandlercmn hands the return value of rdmaresolveroute straight back to the rdmacm on RDMACMEVENTADDRRESOLVED. A synchronous failure there -...

CVE-2026-99210 accel/rocket: clear rdev on device init failure

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

CVE-2026-99211 netlink: reset skb headers before unicast and multicast filtering

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99209 drm/xe: skip eviction of a BO with no resource

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

CVE-2026-99205 sched/core: Call wakeup_preempt() for queued tasks during class change

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99206 scsi: target: iscsi: Fix race in discovery auth updates

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsiupdateparamvalue, causing a double-free...

CVE-2026-99204 ocfs2/dlm: Protect the recovery list during debugfs reads

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

CVE-2026-99203 pipe: preserve existing fasync readers on writer setup failure

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

CVE-2026-99201 netlink: avoid hashing the network namespace pointer

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99202 scsi: libsas: Fix SMP IO deadlock during HA resume

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smpexecutetasksg calls pmruntimegetsync on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the getsync deadlocks: it waits for...

CVE-2026-99200 net: hisilicon: hisi_femac: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

CVE-2026-99199 net: hisilicon: hip04_eth: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...

CVE-2026-99198 net: ethernet: actions: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99197 net: mv643xx: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit in question, ...

CVE-2026-99196 net: au1000: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000probe calls au1000miiprobe, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99195 net: ethoc: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethocprobe calls ethocmdioprobe, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99194 net: ethernet: aeroflex: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99193 net: ti: icssm-prueth: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssmpruethnetdevinit calls ofphygetandconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since...

CVE-2026-99192 net: bcmgenet: unshare the skb before writing the control block

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores firstcb, lastcb and bytessent in the skb control block and reads them back on completion to free the skb and credit BQL. ethersetup leaves...

CVE-2026-99191 calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()

In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payloadlen in calipsoskbuffsetattr calipsoskbuffsetattr adjusts payloadlen by the length of the option it inserts or resizes: payload = ntohsip6hdr-payloadlen; ip6hdr-payloadlen = htonspayload + lendelta; GR...

CVE-2026-99190 gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiodsetarrayvaluecomplex on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochipsetmultiple, gpiodsetarrayvalue returns abruptly, bypassing the freeing of possibly...

CVE-2026-99189 gpio: mxc: fix race between chained IRQ handler install and probe completion

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that...

CVE-2026-99188 net: stmmac: dwmac1000: clear the RGMII status interrupt

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 "net: stmmac: remove SGMII/RGMII/SMII interrupt handling" nothing on the RGMII path reads GMACRGSMIIIS, so RGSMIIIS stays pending behind GMACINTMA...

CVE-2026-99186 x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...

CVE-2026-99187 perf: Fix perf_pmu_migrate_context() leaving events behind

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

CVE-2026-99185 firewire: core: fix race condition in split transaction handling

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fwcorehandleresponse or splittransactiontimeoutcallback may manipulate the same transaction entry in the pending transaction list. T...

CVE-2026-99184 accel/rocket: search every core slot when a core is removed

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...

CVE-2026-99183 accel/rocket: search every core slot when looking up a scheduler

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...

CVE-2026-99182 ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

CVE-2026-99181 autofs: ignore notification errors from a replaced pipe

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

CVE-2026-99180 unicode: free the map after a grace period

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...

CVE-2026-99179 watch_queue: Fix note pool publication race in watch_queue_set_size()

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

CVE-2026-99178 x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apfreason.flags until kvmhandleasyncpf reads and clears it...

CVE-2026-99177 KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

CVE-2026-99176 KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling...

CVE-2026-99175 fsnotify: prevent mark additions during connector teardown

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...