Tagged “cve.org”
CVEs tagged cve.org, newest first.
20161 CVEsRSS
CVE-2026-14563Critical· 9.8The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in a…
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in a…
CVE-2026-18061Medium· 5.9Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files f…
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files f…
CVE-2026-38058High· 8.1The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts
The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with va…
CVE-2026-89518Medium· 5.5kernel: sched_ext: Fix this_rq() assumptions in dispatch kfuncs (CVE-2026-89518)
A flaw was found in the Linux kernel's `sched_ext` component. Under core scheduling, incorrect assumptions in dispatch kfuncs regarding `this_rq()` can lead to a deadlock. This occurs when an `rq` lock is acquired on a CPU different from t…
CVE-2026-89517Medium· 5.5kernel: sched_ext: Fix rq->core_pick corruption under core scheduling (CVE-2026-89517)
A flaw was found in the Linux kernel's `sched_ext` component, which handles core scheduling. When multiple selections on the same core interleave due to a dropped lock, they can corrupt the scheduling state. This corruption can lead to a N…
CVE-2026-89516Medium· 5.5kernel: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users (CVE-2026-89516)
A flaw was found in the Linux kernel's `sched_ext` component. When a Deferred Scheduling Queue (DSQ) is destroyed, a pending deferred re-enqueue (DRU) operation might still attempt to access the destroyed DSQ. This can lead to a `BUG_ON` c…
CVE-2026-89514Medium· 5.5kernel: scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock (CVE-2026-89514)
A flaw was found in the Linux kernel's Fibre Channel over Ethernet Network Interface Card (fnic) driver. The `fnic_fcoe_process_vlan_resp()` function attempts to allocate memory in a way that can cause the system to sleep while holding a s…
CVE-2026-89509Medium· 5.5kernel: RDMA/ionic: Embed counter driver data in rdma_counter allocation (CVE-2026-89509)
A flaw was found in the Linux kernel's RDMA/ionic driver. This vulnerability arises from the driver's incorrect handling of `rdma_counter` allocations, specifically by not embedding counter driver data as required. This oversight can lead …
CVE-2026-89505Medium· 5.5kernel: RDMA/uverbs: Guard legacy bundles without method_elm (CVE-2026-89505)
A flaw was found in the Linux kernel's RDMA/uverbs component. Malformed input from a provider in the legacy write path can cause the `uverbs_get_handler_fn()` function to dereference an uninitialized pointer. This can lead to a system cras…
CVE-2026-89502Medium· 5.5kernel: ring-buffer: Free cpu_buffer::free_page with subbuf_order (CVE-2026-89502)
A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory managem…
CVE-2026-89661Medium· 5.5kernel: NFSD: Prevent post-shutdown use-after-free in unlock_filesystem (CVE-2026-89661)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A local administrator with CAP_SYS_ADMIN capabilities can trigger a use-after-free vulnerability by writing to /proc/fs/nfsd/unlock_filesystem after the NFSD server …
CVE-2026-89592Medium· 5.5kernel: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() (CVE-2026-89592)
A flaw was found in the `accel/rocket` component of the Linux kernel. This vulnerability arises from two issues: a missing null check after a memory allocation failure and an integer overflow when calculating memory requirements based on u…
CVE-2026-89591Medium· 5.5kernel: accel/rocket: initialize job domain before cleanup paths (CVE-2026-89591)
A flaw was found in the Linux kernel's `accel/rocket` module. During error handling in the `rocket_ioctl_submit_job()` function, a cleanup routine may attempt to free a `job->domain` pointer that has not yet been initialized, leading to a …
CVE-2026-89590Medium· 5.5kernel: accel/rocket: Fix error path handling in rocket_job_run() (CVE-2026-89590)
A flaw was found in the `accel/rocket` driver within the Linux kernel. Incorrect error handling in the `rocket_job_run()` function can lead to resource leaks. This occurs when the system fails to properly release references to Direct Memor…
CVE-2026-89589Medium· 4.4In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks The CXL CPER work registration and unregistration helpers acquire cxl_cper_work_lock and cxl_cper_prot_err_w…
In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks The CXL CPER work registration and unregistration helpers acquire cxl_cper_work_lock and cxl_cper_prot_err_w…
CVE-2026-89578Medium· 5.5kernel: dm-io: clone the source bio instead of copying its biovec (CVE-2026-89578)
A flaw was found in the Linux kernel's device mapper I/O (dm-io) component. When handling DM_IO_BIO requests, incorrect sector-based accounting for misaligned direct I/O buffers could lead to an infinite loop. This issue can cause I/O oper…
CVE-2026-89577Nonedm-io: report non-retryable errors separatedly
In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLK_STS_NOTSUPP and BLK_STS_INVAL should not cause leg failure on dm-raid1. This patch changes the inter…
CVE-2026-89572Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple_soc_cpufreq_init() adds OPP tables from firmware, but some failure paths do not remove them
In the Linux kernel, the following vulnerability has been resolved: cpufreq: apple-soc: Fix OPP table cleanup apple_soc_cpufreq_init() adds OPP tables from firmware, but some failure paths do not remove them. The driver also uses dev_p…
CVE-2026-89568Medium· 5.5kernel: kho: fix size calculation in kho_preserved_memory_reserve() (CVE-2026-89568)
A flaw was found in the Linux kernel. The `kho_preserved_memory_reserve()` function, responsible for reserving memory, incorrectly calculates the size of these reservations. This issue arises because it uses a 32-bit integer for bit shifti…
CVE-2026-89567Medium· 5.5kernel: jbd2: bound shrinker scans by examined checkpoint buffers (CVE-2026-89567)
A flaw was found in the Linux kernel's jbd2 shrinker. This component, which manages journal buffers, does not correctly account for busy checkpoint buffers. This oversight can cause the shrinker to hold a critical system lock for an extend…
CVE-2026-89552Medium· 4.1kernel: Linux kernel: Denial of Service via NULL pointer dereference in parameter handling (CVE-2026-89552)
A flaw was found in the Linux kernel. When updating charp parameters, an allocation failure can cause the parameter to be set to NULL before the new value is successfully allocated. This can lead to a kernel NULL pointer dereference, which…
CVE-2026-89543High· 7.0In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs…
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs…
CVE-2026-89539Medium· 5.9kernel: Linux kernel: SUNRPC memory leak due to duplicate CREDS_VALUE options (CVE-2026-89539)
A flaw was found in the SUNRPC subsystem of the Linux kernel. The `gssx_dec_option_array()` function, responsible for decoding options, does not correctly handle replies containing duplicate `CREDS_VALUE` entries. This oversight causes the…
CVE-2026-89531Medium· 5.5kernel: svcrdma: Reject connection when transport allocation fails (CVE-2026-89531)
A flaw was found in the Linux kernel's svcrdma module. A remote attacker can exploit this vulnerability by repeatedly attempting connections when the system is under memory pressure. This can lead to a resource leak of `rdma_cm_id` objects…
CVE-2026-89529High· 7.0kernel: svcrdma: Reject oversized Read segments at decode time (CVE-2026-89529)
A flaw was found in the Linux kernel's svcrdma component, which handles Remote Procedure Call over Remote Direct Memory Access (RPC/RDMA) Read operations. This vulnerability occurs because the Read list decoder does not properly validate t…
CVE-2026-89527Medium· 5.5kernel: svcrdma: Use svc_xprt_put to free listener on create failure (CVE-2026-89527)
A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when a listener creation fails, leading to an improper release of a network namespace reference. This resource leak can be exploited by a local attacker, pote…
CVE-2026-89519Medium· 5.5kernel: sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return (CVE-2026-89519)
A flaw was found in the Linux kernel's `sched_ext` component. Due to a logical error where a stale flag (`SCX_RQ_BAL_KEEP`) could be consumed, the scheduler might incorrectly keep a task running even after it has been dequeued. This could …
CVE-2026-62111Medium· 6.5WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.
CVE-2026-54135High· 7.5PoCAirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol
AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to c…
CVE-2026-89739High· 7.0In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with dwc3_nostream…
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with dwc3_nostream…