CVE-2026-80988: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NTB: ntbtransport: Fail TX enqueue when the QP link is down Commit f195a1a6fe41 "ntb: Drop packets when qp link is down" meant to make ntbtransporttxenqueue drop packets submitted while the QP link is down, but it only returns 0...

CVE-2026-89728: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...

CVE-2026-81010: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: honor taskwork cancellation iowaitidcb may run through the fallback taskwork path when taskworkadd can no longer queue work to the originating task. The fallback runs from a kworker and iouring marks such task wor...

CVE-2026-47773: Incorrect Calculation of Buffer Size

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBL...

CVE-2026-89156: Out-of-bounds Read

PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...

CVE-2026-89470: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd: Limit port counts to ECUSBPDMAXPORTS Currently the crosusbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB...

CVE-2026-89664: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

CVE-2026-14566: Authorization Bypass Through User-Controlled Key

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

CVE-2026-81007: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmbwrite read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block writ...

CVE-2026-90450: Incorrect Authorization

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-89722: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio pciwritelegacyio loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; return...

CVE-2026-18121: Missing Authorization

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...

CVE-2026-89659: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4client and does not keep it alive. The client survives its stateids only because destroyclient drains...

CVE-2026-89457: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

CVE-2026-62102: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...

CVE-2026-17037: Improper Neutralization of Input During Web Page Generation

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-89250: Missing Authentication for Critical Function

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

CVE-2026-6642: Improper Neutralization of Input During Web Page Generation

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

CVE-2026-89612: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

CVE-2026-89256: Improper Neutralization of Input During Web Page Generation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89509: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89506: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBSATTRUHW to UVERBSMETHODREGMR The original commit missed that three drivers mthca, irdma, siw have UHW data associated with regmr that cannot be passed through the ioctl. They also assume that the udata cann...

CVE-2026-90443: Improper Neutralization of Input During Web Page Generation

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

CVE-2026-89518: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

CVE-2026-81916: Missing Authorization

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

CVE-2026-89588: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89253: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

CVE-2026-89751: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-88914: Integer Overflow or Wraparound

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-89243: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

CVE-2026-89693: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

CVE-2026-80945: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req-dst with the CPU while it is still mapped DMAFROMDEVICE. With SWIOTL...

CVE-2026-80973: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-86813: Improper Neutralization of CRLF Sequences

The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted...

CVE-2026-89535: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdmarnunregister before rdmadestroyid svcrdmafree caches rdma-sccmid-device before teardown, then calls rdmadestroyidsccmid which frees the cmid. rpcrdmarnunregister follows, but between those two calls the...

CVE-2026-89553: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted...

CVE-2026-62111: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...

CVE-2026-89263: Missing Authentication for Critical Function

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89697: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-62139: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

CVE-2026-49439: Missing Authorization

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue...

CVE-2026-79035: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the p.rfihub.com component of Zeta Marketing Platform ZMP v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter...

CVE-2026-80980: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

CVE-2026-89640: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cifs: fix lofft underflow in cifsremapfilerange when len == 0 With len == 0 clone to EOF, the effective length is computed as: len = srcinode-isize - off; If off isize, this is a negative lofft, corrupting the ByteCount in the...

CVE-2026-62106: Incorrect Privilege Assignment

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.9 versions...

CVE-2026-71644: Access of Resource Using Incompatible Type

An issue in Robotics-STAR-Lab SYSU STAR Group RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE...

CVE-2026-89446: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xastore failure iommufdtakealliovarwsem takes an object reference and the iovarwsem write lock before storing the IOAS in the temporary ioaslist xarray. If xastore fails, the current IOAS has not...

CVE-2026-89517: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix rq-corepick corruption under core scheduling Core scheduling's picknexttask picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consistent...

CVE-2026-89739: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3gadgetfreeendpoints due to race condition In dwc3gadgetinitendpoint, &dep-nostreamwork is bound with dwc3nostreamwork, and dwc3gadgetendpointstreamevent can queue this delayed work on...