CVE-2026-14230

In ECS (Ele Custom Skin) plugin for Elementor before 4.3.8, Dynamic Repeater AJAX handlers lack capability and object-ownership checks. A low-privileged Contributor can write unsanitized data-source bindings into any post, including admin pages, causing stored XSS that fires in visitor or admin s...

CVE-2026-14229

The ECS WordPress plugin before version 4.3.8 lacks capability and post-status checks on its AJAX rendering action (ecsload), allowing unauthenticated attackers to retrieve rendered content of unpublished posts (private, draft, pending) by supplying a document identifier. CVSS 5.3 MEDIUM; CISA fl...

CVE-2026-16541

The Simply Schedule Appointments WordPress plugin (before 1.6.12.17) exposes user names and email addresses via its Users and Customers REST endpoints to any authenticated Team Member+ role, requiring only low privileges; the fix is to upgrade to version 1.6.12.17. No exploitation evidence is pro...

CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 fails to restrict its post-restore auto-login mechanism in multisite deployments. A site admin can trigger a restore on another site in the network, obtaining a long-lived admin session without credentials and bypassing 2FA. CISA flags it as expl...

CVE-2026-74438

The CVE-2026-74438 issue concerns the Linux kernel crypto sun4i-ss RNG code, which has been removed because it was insecure and unused. The vulnerabilities include sun4i_ss_prng_seed() lacking proper locking and a buffer overflow, and sun4i_ss_prng_generate() failing to fill the full buffer due t...

CVE-2026-74439

CVE-2026-74439 affects the Linux kernel IOMMU VT-d path. The vulnerability arises in device_pasid_table_teardown(), which zeroes a 128‑bit scalable‑mode context entry while the Present bit is still set. This creates a window where a torn entry could be fetched by the hardware with some fields alr...

CVE-2026-74437

In the Linux kernel, CVE-2026-74437 affects the media: uvcvideo path. The vulnerability arises when a UVC camera with an asynchronous control triggers a path where uvc_status_stop is called from within async_ctrl.work, leading to a potential deadlock: cancel_work_sync waits for uvc_ctrl_status_ev...

CVE-2026-74435

Summary (CVE-2026-74435) : In the Linux kernel, a fix was applied to rxrpc_verify_data and related code paths (rxrpc_recvmsg_data) to ensure rxdec_buffer is allocated when rx_dec_buffer is NULL. Previously, rxrpc_verify_data could return without allocating the buffer if rxrpc_skb_priv.len was zer...

CVE-2026-74436

CVE-2026-74436 affects the Linux kernel rxrpc subsystem. The issue arises when rxrpc_kernel_charge_accept() reads rx->backlog without proper socket/backlog synchronization, passing a raw pointer into rxrpc_service_prealloc_one() while a concurrent rxrpc_discard_prealloc() may set rx->backlo...

CVE-2026-74434

The CVE-2026-74434 issue affects the Linux kernel rxrpc path: when reading an OOB message with MSG_PEEK, rxrpc_recvmsg_oob() unlinks from recvmsg_oobq but always moves the message onto pending_oobq, risking the sk_buff rbnode linkage being overwritten. This allows the skb to be reachable from bot...

CVE-2026-74433

In the Linux kernel, CVE-2026-74433 describes a use-after-free (UAF) in rxgk_issue_challenge() within rxrpc. The bug occurs because a page containing the challenge content is freed after a tracepoint is invoked, while the whdr referenced by the tracepoint points into that same page. The fix updat...

CVE-2026-74432

The CVE-2026-74432 issue affects the Linux kernel’s rxrpc recvmsg path. The fix adds dropping of a reference on an already-released call when MSG_PEEK is in force, addressing a leak where a ref was held regardless of MSG_PEEK usage. Affected component: rxrpc_recvmsg() in the kernel; root cause: l...

CVE-2026-74431

The CVE-2026-74431 entry affects the Linux kernel’s rxrpc path. The vulnerability is described as a potential infinite loop in rxrpc_recvmsg(), with a fix that also makes the wait path check the oob queue. The issue is addressed by applying the kernel patches (e.g., the commits listed in the refe...

CVE-2026-74429

CVE-2026-74429 describes a Linux kernel issue in rxrpc where a reply DATA packet can be received before the client has sent any request DATA packets, potentially causing an oops in rxrpc_rotate_tx_window. The fix updates rxrpc_receiving_reply() to detect an apparent reply before exposure of the c...

CVE-2026-74430

The CVE-2026-74430 issue affects the Linux kernel’s rxrpc ACKALL handling. It allowed a forged ACKALL to reach a new service call before replies were queued, risking a null-pointer dereference when rxrpc_rotate_tx_window() dereferenced a NULL txqueue (call->tx_top was zero). The fix adds two c...

CVE-2026-74427

The CVE-2026-74427 entry concerns the Linux kernel AFS subsystem. Affected component: afs code handling network namespaces and preallocation charging. Root cause: during netns teardown, the work item that precharges the rxrpc queue could remain active, and when net->live is false the charging ...

CVE-2026-74428

The CVE-2026-74428 entry pertains to the Linux kernel, specifically a vulnerability in rxrpc_recvmsg() where a double unlock occurs while handling OOB messages. The issue is concrete: the function path for OOB messages can unlock a resource twice, potentially leading to memory corruption or simil...

CVE-2026-74426

CVE-2026-74426 (Linux kernel) : A NULL pointer dereference in the AFS filesystem during afs_get_tree() was fixed. The root cause involved afs_alloc_sbi() using kzalloc and, if ctx->dyn_root is non-null, as->cell and as->volume being null, leading to dereferencing these fields in trace_af...

CVE-2026-74425

In the Linux kernel, CVE-2026-74425 affects the AFS cache manager: CB.InitCallBackState3 requests could arrive without an attached server record to the rxrpc peer’s app data. The fix makes CB.InitCallBackState3 follow the same pattern as other callbacks by checking for an attached server record b...

CVE-2026-74424

CVE-2026-74424 affects the Linux kernel framebuffer console driver (fbcon). The issue arises when fbcon_new_modelist() iterates consoles with fb_display[i].mode set; it can dereference a NULL vc_data because fbcon_set_disp() may set mode before validating vc_data, and fbcon_deinit() can leave the...