Tagged “cve.org”
CVEs tagged cve.org, newest first.
18494 CVEsRSS
CVE-2026-89765Medium· 5.5kernel: timers/itimer: Zero-init old itimerval before copy to userspace (CVE-2026-89765)
A flaw was found in the Linux kernel's `timers/itimer` component. On native sparc64 systems, the `struct __kernel_old_timeval` contains uninitialized padding bytes. When `put_itimerval()` copies this structure to userspace, these padding b…
CVE-2026-89756Medium· 5.5kernel: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (CVE-2026-89756)
A flaw was found in the Linux kernel. When performing memory migration on KVM (Kernel-based Virtual Machine) hosts, the `migrate_pages_batch()` function fails to report RCU (Read-Copy Update) tasks quiescent states during large batch unmap…
CVE-2026-89753Medium· 5.5kernel: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (CVE-2026-89753)
A flaw was found in the Linux kernel's memory management subsystem. The `shrink_lruvec()` function, responsible for memory reclaim, fails to properly report Read-Copy-Update (RCU) task quiescent states on systems with preemption enabled. T…
CVE-2026-89752Medium· 5.5kernel: mm: memcg: stop reclaim when a limit update is superseded (CVE-2026-89752)
A flaw was found in the Linux kernel's memory cgroup (memcg) component. When multiple file operations concurrently update `memory.high` or `memory.max` files in `kernfs`, a writer can continue reclaiming memory towards an outdated target. …
CVE-2026-89751Medium· 5.5kernel: x86/tdx: Fix off-by-one in port I/O handling (CVE-2026-89751)
A flaw was found in the Linux kernel's x86/tdx component. An off-by-one error in the `handle_in()` and `handle_out()` functions, specifically in the `GENMASK` calculation for port I/O operations, causes the mask to be one bit too wide. Thi…
CVE-2026-89750Medium· 5.5⚖ disputedkernel: tracing/user_events: Clear copied tracing state before fork duplication (CVE-2026-89750)
A flaw was found in the Linux kernel's tracing/user_events component. This vulnerability arises when a child process, created via `fork`, exits and frees memory that the parent process still references. This creates a Use-After-Free (UAF) …
CVE-2026-89749Medium· 5.5kernel: tracing: Fix crash passing ERR_PTR to kthread_stop() (CVE-2026-89749)
A flaw was found in the Linux kernel. Specifically, within the tracing subsystem, the `event_test_stuff()` function can pass an invalid error pointer to `kthread_stop()` if `kthread_run()` fails to create a kernel thread. This improper han…
CVE-2026-90457Medium· 6.2The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local …
The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local …
CVE-2026-90456High· 8.1An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the s…
CVE-2026-90455Low· 3.7⚖ disputedA prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that compone…
CVE-2026-90454Medium· 4.3A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, …
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, …
CVE-2026-90453Low· 3.5A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craf…
CVE-2026-90452Medium· 5.3Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the…
CVE-2026-90451Medium· 5.9⚖ disputedAn example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration w…
CVE-2026-90445Medium· 6.5An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attack…
CVE-2026-90444High· 8.8A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, all…
CVE-2026-90443Medium· 5.4A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a lin…
CVE-2026-81907High· 7.1Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforc…
Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforc…
CVE-2026-68535Medium· 4.3Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the refe…
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the refe…
CVE-2026-81918Medium· 4.8Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed …
CVE-2026-81917Medium· 5.4Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed …
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed …
CVE-2026-81916Medium· 4.3Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route
Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to o…
CVE-2026-81915Medium· 5.3Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEdi…
CVE-2026-68526Medium· 4.3Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canA…
Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canA…
CVE-2026-18122Medium· 6.0Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth…
CVE-2026-81010High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…
CVE-2026-80964Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's O…
CVE-2026-62105Critical· 9.8Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
CVE-2026-6640Medium· 6.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. …
CVE-2026-87727Medium· 6.5a-blog cms Ver
a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product.