CVE-2026-97527

The Linux kernel contains a vulnerability in the scsi: qla2xxx driver where the fcport->unsol_ctx_head list is modified from multiple contexts without a common lock. Specifically, entries are added via qla2xxx_process_purls_iocb() (under the qpair qp_lock) and removed from qla2xxx_process_purl...

CVE-2026-97526

A vulnerability in the Linux kernel (s390/pai) allows for a kernel panic when CPUs are hotplugged during a perf stat command execution, specifically using pai_crypto/CRYPTO_ALL/. The root cause is the missing allocation of per-CPU data structures for newly added CPUs; the existing dynamic allocat...

CVE-2026-97525

The Linux kernel contains a vulnerability where split page tables are allocated without using standard allocation routines (like pte_alloc_one_kernel()) during large page splits (__split_large_page()). This prevents the page table constructor from being called and, critically, fails to mark the p...

CVE-2026-97523

The Linux kernel is affected by a race condition within the mptcp component. Specifically, the mptcp scheduler may race with a subflow sockets state change , causing data transmission on a selected socket to fail. This failure can lead to a subsequent release attempting to use mss_now reset to 0 ...

CVE-2026-97524

The Linux kernel contains a vulnerability in the mptcp component where the receive path can recursively call mptcp_data_ready() during specific error conditions. This recursion attempts to hold the data lock again, potentially causing issues. The fix involves breaking the recursion loop by explic...

CVE-2026-97522

The Linux kernel contains a vulnerability within the mptcp module involving incorrect accounting in the __mptcp_subflow_push_pending() function. The issue arises because the system was updating copied byte counters even when __subflow_push_pending() returned an error, leading to potential mismatc...

CVE-2026-97898

The Akia keyless entry cloud service contained an Insecure Direct Object Reference (IDOR) vulnerability due to missing object-level authorization. The unlock action failed to validate client-supplied room or door identifiers against the authenticated guest's specific booking on the server-side. T...

CVE-2026-92106

The dashbitco lazy_html library (versions 0.1.0 before 0.1.13 ) is vulnerable to Mutation XSS due to improper neutralization of input during web page generation. The root cause lies in the LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 functions, which fail to correctly escape text within style o...

CVE-2026-88848

The MasterStudy LMS WordPress plugin (versions 1.9 to

CVE-2026-80514

The wpForo Forum WordPress plugin (versions 3.0.0 through 3.1.5 ) is vulnerable to unauthenticated AI credit exhaustion . The root cause is a failure to verify the source of client-supplied IP address headers, which are used to key the per-visitor rate limit on paid AI requests. An attacker can b...

CVE-2026-6088

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile software by Novadigits technologies. The flaw is located in the REST endpoint /inventory/configuration/categories within the API and management panel. It allows an authenticated attacker to inject and persist malicious Jav...

CVE-2026-6087

The StockAgile platform by Novadigits technologies contains a Stored Cross-Site Scripting (XSS) vulnerability within its API and management panel . Specifically, the server-side REST endpoint /inventory/configuration/categories fails to properly filter or validate inputs in parameters such as 'co...

CVE-2026-6086

The StockAgile application by Novadigits technologies contains a Stored Cross-Site Scripting (XSS) vulnerability in its API and management panel. Specifically, the REST endpoint /inventory/configuration/serial-number-types fails to properly filter or validate inputs from parameters like code, nam...

CVE-2026-6085

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile API and management panel developed by Novadigits technologies. The flaw is located on the server side within the REST endpoint /inventory/configuration/serial-number-types. It allows a remote, previously authenticated atta...

CVE-2026-86837

The Bookly WordPress plugin versions prior to 28.3 contains a vulnerability where it fails to properly verify a customer's identity during personal information updates. An unauthenticated attacker who possesses a customer's primary identifier can exploit this verification bypass to overwrite sens...

CVE-2026-6084

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile application by Novadigits technologies, specifically within the API and management panel . The flaw is located in the server-side REST endpoint /inventory/configuration/variants, where the system fails to properly filter o...

CVE-2026-6083

The StockAgile application by Novadigits technologies contains a Stored Cross-Site Scripting (XSS) vulnerability within the API and management panel. The flaw exists in the REST endpoint /inventory/configuration/pricing-tiers, where the application fails to properly filter or validate input in pa...

CVE-2026-6082

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile API and management panel by Novadigits technologies. The flaw is located in the REST endpoint /inventory/configuration/payment-methods, where malicious JavaScript can be injected and persisted via parameters such as 'code'...

CVE-2026-92550

The Apache Qpid Broker-J software (versions through 10.1.0 ) is vulnerable to a denial of service (DoS) attack. A pre-authentication attacker can exploit improper type size/count handling within the AMQP 0-8/0-9/0-9-1 decoder to trigger excessive memory allocation. To mitigate this risk, users sh...

CVE-2026-92560

The Apache Qpid Broker-J software (versions through 10.1.0) is vulnerable to a denial of service condition. A pre-authentication attacker can exploit improper type size/count handling within the AMQP 0-10 decoder to trigger excessive allocation . To remediate this issue, users are recommended to ...