Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 599

2 critical, 65 high, 73 medium, 31 low

17311 advisories Export 725 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	Low	1.9	CVE-2026-116228	A vulnerability was found in 777genius agent-teams-ai up to 2.17.10 777genius777genius agent-teams-ai	NVD	Oct 26 07:17 UTC
CVE-2026-116228A vulnerability was found in 777genius agent-teams-ai up to 2.17.10 Executive summary A vulnerability was found in agent-teams-ai by 777genius, affecting versions up to 2.17.10, that may leak sensitive information. The advisory is mostly a Google Drive page listing files and does not state a severity rating or a vendor recommendation. Technical summary The advisory describes a sensitive information leakage flaw, and the title references an unauthenticated MCP HTTP proof-of-concept file. The affected versions are stated as up to 2.17.10. Attack vector and preconditions are not stated in the text provided. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. The advisory text is largely a shared-file listing and contains no CVSS score, exploitation status, or technical details beyond the title. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from drive.google.com/drive/folders/1Fhsrm4J…9LNyoDG5?usp=sharing Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects 777genius 777genius agent-teams-ai NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Low	1.9	CVE-2026-116227	A vulnerability has been found in Edimax BR-6208AC 1.32 EdimaxEdimax BR-6208AC	NVD	Oct 26 07:17 UTC
CVE-2026-116227A vulnerability has been found in Edimax BR-6208AC 1.32 Executive summary A stored cross-site scripting flaw has been reported in the Edimax BR-6208AC router, firmware BR-6208AC_1.32. The advisory describes it as a stored script injection in the Virtual Server page that can run for anyone who visits that page. The advisory does not state a severity score, and it does not say whether a fix or workaround is available. Technical summary The flaw is a stored cross-site scripting (XSS) vulnerability in the Comment field of the Virtual Server page under the Advanced settings. The advisory says the client-side check on the Comment value is not repeated on the server, so a crafted request sent through a proxy such as BurpSuite can save script content. The script then runs when the Virtual Server page is loaded, including by other users who visit that page. The attack preconditions, such as whether authentication is required, are not stated. The affected firmware is stated as BR-6208AC_1.32, and no fixed version is stated. No workaround and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/fizz-is-on-the-way/Iot_vuls/…C/XSS_Virtual_Server Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Edimax Edimax BR-6208AC NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Low	2.1	CVE-2026-116224	A vulnerability has been found in fr0tt benotes up to 2.8.1 fr0tt, laravelLaravel, fr0tt benotes	NVD	Oct 26 07:17 UTC
CVE-2026-116224A vulnerability has been found in fr0tt benotes up to 2.8.1 Executive summary A server-side request forgery flaw has been reported in fr0tt benotes version 2.8.1 and earlier. Any logged-in user can make the server fetch internal addresses and read parts of the responses, which may expose internal content. The advisory gives a CVSS 3.1 base score of 4.3 (Medium) and does not state a vendor-issued fix or recommendation beyond the remediation steps the researcher proposes. Technical summary The flaw is CWE-918 server-side request forgery in the GET /api/meta endpoint, which requires an authenticated account; the advisory states accounts are created by an admin and there is no public self-registration. The URL is validated only with Laravel's url rule, which accepts any scheme, and is then fetched with curl_exec with CURLOPT_FOLLOWLOCATION enabled and no private-address or redirect checks. The advisory shows loopback fetches, redirect following, and file:// URLs reaching libcurl, with partial title and description read-back in JSON. Affected version is stated as 2.8.1 (master branch, commit cb803b32340eb7720131a9d0b93261d01800c896), and the phrase 'up to 2.8.1' appears in the advisory. No fixed version, vendor patch, or exploitation in the wild is stated. Proposed remediation is a http/https allow-list, IP range blocking with IP pinning, redirect re-validation or disabling follow-redirects, and the same policy for the Chrome crawler. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/qianqiusujiu/58f979be4c…bd1cf2864d85e79603d8 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects fr0tt laravel Laravel fr0tt benotes NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116223	A flaw has been found in icret EasyImage up to 2.8.7 icreticret EasyImage, icret EasyImages2.0	NVD	Oct 26 07:17 UTC
CVE-2026-116223A flaw has been found in icret EasyImage up to 2.8.7 Executive summary A flaw has been found in icret EasyImage up to version 2.8.7, a PHP image hosting product. The advisory says an unauthenticated attacker can delete hosted images, and the exploit write-up describes possible permanent data loss. The advisory does not state a CVSS score from the NVD record; the disclosure text it contains gives a CVSS 3.1 base score of 7.4 (High), and the vendor's recommended fixes are to put the delete path behind the admin login check and to replace the weak key derivation. Technical summary The advisory describes CWE-326 (inadequate encryption strength): delete links are AES-128-XTS encryptions of the file path keyed with a 32-bit value derived from crc32 of the admin password, with a hardcoded tweak. The hash-based delete branch in app/del.php runs before the admin authentication check, so a forged or recovered token deletes files without a session. The advisory states that anonymous upload is enabled by default and that a full 2^32 key sweep took about 850.7 seconds on 16 workers. Affected version is stated as 2.8.7 (master branch, commit dcb9776cb9567b9280306471a66d96b4b733a0a1); the advisory does not state a fixed version. Workarounds beyond the listed remediation steps and vendor patch status are not stated, and no detection guidance is given beyond the control test showing the denial without a hash parameter. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/yyz8097/bc58546872ad90208d2b35260d84b1d9 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects icret icret EasyImage icret EasyImages2.0 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116124	A security vulnerability has been detected in GNOME libgsf up to 1.14.60 GnomeGnome libgsf	NVD	Oct 26 07:17 UTC
CVE-2026-116124A security vulnerability has been detected in GNOME libgsf up to 1.14.60 Executive summary A security flaw has been found in GNOME libgsf, a library used to read structured document files, in versions up to 1.14.60. The advisory says it can be triggered remotely and that a patch is available, which is the recommended fix. Technical summary The flaw is a heap-based buffer overflow in the function ole_info_read_metabat in gsf/gsf-infile-msole.c, part of the OLE2 parser. The advisory says the attack can be started remotely, presumably by supplying a crafted file, but it does not describe the exact trigger or required user interaction. Affected versions are stated as up to 1.14.60, and the fixed version is not stated; the advisory gives a patch identifier, a8e25560b74f84c3f86df6ca0ac59195fa5af68a, instead. No workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Gnome Gnome libgsf NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Medium	5.3	CVE-2026-111974	The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers,... GiveWPGiveWP	NVD	Oct 26 07:17 UTC
CVE-2026-111974The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers,... Executive summary The GiveWP WordPress plugin, a donation plugin used on WordPress sites, is affected by a flaw that lets donations be processed in a currency the site or form does not accept. The advisory does not state a severity rating, but the fix is available in version 4.19.0.1, and the advisory indicates that users should update to that version. Technical summary The flaw is a logic weakness in which the plugin does not restrict a donation to the currency the site or form accepts, and it compares amount limits as bare numbers without considering currency. The advisory describes the affected range as versions before 4.19.0.1 and gives 4.19.0.1 as the fixed version. The attack vector, required privileges, and whether user interaction is needed are not stated. A CVSS score is not stated. Workarounds and detection guidance are not stated. The advisory also lists several unrelated plugin vulnerabilities in a references section, which are not part of this flaw. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2d7c0c89-7f0e-…2b-908f-7d96e1d8a228 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	High	8.4	CVE-2026-107900	V-SFT provided by FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., FUJI ELECTRIC CO., LTDFUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT, FUJI ELECTRIC CO., LTD V-SFT-6	NVD	Oct 26 07:17 UTC
CVE-2026-107900V-SFT provided by FUJI ELECTRIC CO., LTD Executive summary Fuji Electric's V-SFT-6 human machine interface software, version V6.2.12.0, is the subject of this advisory. The text provided is mainly a page of improvement information and license terms, so the nature and severity of any security flaw is not stated. Technical summary The advisory does not describe a vulnerability class, CVE-specific flaw details, or an attack vector, and it does not state preconditions. The affected product is named as V-SFT-6 with document number VSFT6 V6.2.12.0, published October 2026, but affected version ranges and fixed versions are not stated beyond that. No CVSS score, workaround, mitigation, exploitation status, or detection guidance is stated. The remaining text is a software license agreement and disclaimer. Defenders should consult the vendor's improvement information directly for technical details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from felib.fujielectric.co.jp/en/M10010/M200…21066b?region=en-glb Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT FUJI ELECTRIC CO., LTD V-SFT-6 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	High	8.4	CVE-2026-107899	V-SFT provided by FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., FUJI ELECTRIC CO., LTDFUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT, FUJI ELECTRIC CO., LTD V-SFT-6	NVD	Oct 26 07:17 UTC
CVE-2026-107899V-SFT provided by FUJI ELECTRIC CO., LTD Executive summary This page is a Fuji Electric product improvement notice for the V-SFT-6 human machine interface software, version V6.2.12.0. The text is mostly a software license agreement and does not describe a specific security flaw, its severity, or a vendor fix recommendation in the words provided. Technical summary The advisory does not describe a vulnerability class, attack vector, or preconditions. Affected versions are only referenced as V-SFT-6 Ver.V6.2.12.0 and document number VSFT6 V6.2.12.0, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated. The text consists of a license agreement, so the security impact of the improvement is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from felib.fujielectric.co.jp/en/M10010/M200…21066b?region=en-glb Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT FUJI ELECTRIC CO., LTD V-SFT-6 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	High	8.4	CVE-2026-107898	V-SFT provided by FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., FUJI ELECTRIC CO., LTDFUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT, FUJI ELECTRIC CO., LTD V-SFT-6	NVD	Oct 26 07:17 UTC
CVE-2026-107898V-SFT provided by FUJI ELECTRIC CO., LTD Executive summary The advisory is a Fuji Electric page about an improvement update for V-SFT-6 human machine interface software, version V6.2.12.0, published October 2026. The text is mostly license terms and does not describe a specific security flaw, its severity, or the vendor's recommended action. Technical summary The advisory does not describe a vulnerability class, attack vector, or preconditions. The page is a technical document listing for V-SFT-6 Ver.V6.2.12.0 with the document number VSFT6 V6.2.12.0 and publication month Oct. 2026, but the body text is a license agreement for downloaded information and software. No affected version range, fixed version, workaround, exploitation status, CVSS score, or detection guidance is stated in the advisory text. The nature of the improvement is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from felib.fujielectric.co.jp/en/M10010/M200…21066b?region=en-glb Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT FUJI ELECTRIC CO., LTD V-SFT-6 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	High	8.4	CVE-2026-107897	V-SFT provided by FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., FUJI ELECTRIC CO., LTDFUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT, FUJI ELECTRIC CO., LTD V-SFT-6	NVD	Oct 26 07:17 UTC
CVE-2026-107897V-SFT provided by FUJI ELECTRIC CO., LTD Executive summary Fuji Electric published an improvement notice for its V-SFT-6 human machine interface software, version V6.2.12.0, dated October 2026. The advisory text provided is mostly a license agreement and does not describe the vulnerability, its severity, or a recommended fix in detail. Technical summary The advisory text does not describe a specific vulnerability class, attack vector, or preconditions. Affected versions are not stated beyond the document reference VSFT6 V6.2.12.0, and no fixed version is given. No workaround, detection guidance, CVSS score, or information about exploitation in the wild is stated. The page content is largely a software license and usage agreement, so the technical details of the flaw must be obtained from the vendor's full improvement document. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from felib.fujielectric.co.jp/en/M10010/M200…21066b?region=en-glb Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT FUJI ELECTRIC CO., LTD V-SFT-6 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	High	8.4	CVE-2026-107896	V-SFT provided by FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., FUJI ELECTRIC CO., LTDFUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT, FUJI ELECTRIC CO., LTD V-SFT-6	NVD	Oct 26 07:17 UTC
CVE-2026-107896V-SFT provided by FUJI ELECTRIC CO., LTD Executive summary The advisory is a Fuji Electric page describing improvement information for V-SFT-6 version V6.2.12.0, a human machine interface software product. The text is mostly license terms and does not describe a specific security flaw, its severity, or a vendor recommendation. Technical summary The advisory does not describe a vulnerability class, attack vector, or preconditions. It names V-SFT-6 Ver.V6.2.12.0 under document number VSFT6 V6.2.12.0, published Oct. 2026, but does not state affected versions, fixed versions, workarounds, or detection guidance. Whether this page relates to a security issue is not stated. The remaining text is a software license agreement with use restrictions and disclaimers. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from felib.fujielectric.co.jp/en/M10010/M200…21066b?region=en-glb Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT FUJI ELECTRIC CO., LTD V-SFT-6 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	High	8.4	CVE-2026-107895	V-SFT provided by FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., FUJI ELECTRIC CO., LTDFUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT, FUJI ELECTRIC CO., LTD V-SFT	NVD	Oct 26 07:17 UTC
CVE-2026-107895V-SFT provided by FUJI ELECTRIC CO., LTD Executive summary The advisory is a Fuji Electric vendor page describing an improvement release for V-SFT-6, a human machine interface software product. The page does not describe a specific security flaw, its severity, or a remediation the vendor recommends for a vulnerability. Technical summary The advisory text is a download page for V-SFT-6 Ver.V6.2.12.0 improvement information, followed by a license agreement for technical documents and software. It does not name a vulnerability class, attack vector, or preconditions. It does not state any affected versions, fixed versions, workarounds, exploitation status, or detection guidance. The only version given is V6.2.12.0 as the document subject, which is not described as affected. Vulnerability details are not stated in the supplied text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from felib.fujielectric.co.jp/en/M10010/M200…21066b?region=en-glb Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT FUJI ELECTRIC CO., LTD V-SFT NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	High	8.4	CVE-2026-107894	V-SFT provided by FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., FUJI ELECTRIC CO., LTDFUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT, FUJI ELECTRIC CO., LTD V-SFT-6	NVD	Oct 26 07:17 UTC
CVE-2026-107894V-SFT provided by FUJI ELECTRIC CO., LTD Executive summary The advisory is a Fuji Electric page about an improvement release for the V-SFT-6 human machine interface software, version V6.2.12.0. The text is mostly license terms and does not describe a specific security flaw, its severity, or a vendor recommendation for security fixes. Technical summary The advisory does not describe a vulnerability class, attack vector, or preconditions. It names document number VSFT6 V6.2.12.0 and publication month Oct. 2026 for V-SFT-6 improvement information, but the text does not say what was improved or whether the change is security-related. Affected versions beyond the named release are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. CVSS score and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from felib.fujielectric.co.jp/en/M10010/M200…21066b?region=en-glb Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.FUJI ELECTRIC CO., LTD FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. V-SFT FUJI ELECTRIC CO., LTD V-SFT-6 NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-103381	The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark... MintpayMintpay for WooCommerce	NVD	Oct 26 07:17 UTC
CVE-2026-103381The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark... Executive summary The Mintpay for WooCommerce WordPress plugin, through version 2.2.3, has a flaw that lets unauthenticated attackers mark payments as completed without a genuine payment. The advisory describes this as a medium severity issue with a CVSS score of 6.5, and it states no known fix is available. Technical summary The flaw is a broken access control issue (CWE-284) in which the plugin does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark payments as paid. The attack requires no authentication, and the advisory's details on the exact request path are not stated. Affected versions are stated as through 2.2.3. No fixed version is stated, and the advisory says there is no known fix. Workarounds are not stated. Detection guidance is not stated. The advisory's text is truncated, so further detail may be missing. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/593fa052-8917-…6c-944b-11b890c9ab50 Score No CVSS score published. Affects Mintpay Mintpay for WooCommerce NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-103319	The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret... OPayOPay Payment Gateway for WooCommerce	NVD	Oct 26 07:17 UTC
CVE-2026-103319The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret... Executive summary The OPay Payment Gateway for WooCommerce WordPress plugin, through version 2.5.5, fails to properly verify that payment notifications come from the payment provider. The advisory rates this as medium severity with a CVSS score of 5.3, and no fixed version is stated. Technical summary The flaw is an authentication bypass (CWE-287, OWASP A2 Broken Authentication) in the OPay Payment Gateway for WooCommerce plugin, through 2.5.5. The advisory states that the plugin does not properly verify that payment notifications originate from the payment provider, as the secret is involved, but the text is truncated and the full precondition is not shown. The CVSS score given is 5.3 (medium). No fixed version is stated and the advisory lists no known fix. No workaround, vendor remediation, detection guidance, or evidence of exploitation in the wild is stated. The page also lists unrelated plugin titles and dates, which are not part of this flaw and were not used. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/c07f15a0-3c15-…9f-bcde-1511ad658c6c Score No CVSS score published. Affects OPay OPay Payment Gateway for WooCommerce NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-103306	The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation,... iK Pay, ikhokhaiK Pay Gateway, ikhokha-payment-gateway	NVD	Oct 26 07:17 UTC
CVE-2026-103306The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation,... Executive summary The Online Payments with iK Pay Gateway WordPress plugin, published under the name ikhokha-payment-gateway, is affected by an authentication bypass in versions before 3.0.4. The advisory says the flaw is rated medium severity with a CVSS score of 5.3, and the fix is to update to version 3.0.4. Technical summary The weakness is classified as CWE-287 (improper authentication) and the advisory labels it AUTHBYPASS. The plugin does not properly verify the authenticity of its payment gateway callback on a default installation. The advisory does not state the attack vector details, the exact preconditions beyond default installation, or whether exploitation has been observed in the wild. The affected versions are stated as before 3.0.4 and the fixed version is 3.0.4. The advisory does not state any workaround or detection guidance. The CVSS score given is 5.3 (medium), and no CVSS vector string is provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2d888e78-ed1f-…68-9bdc-19e9420f6956 Score No CVSS score published. Affects iK Pay ikhokha iK Pay Gateway ikhokha-payment-gateway NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Medium	5.3	CVE-2026-103300	The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and... EurobankEurobank WooCommerce Payment Gateway, Eurobank woo-payment-gateway-for-eurobank	NVD	Oct 26 07:17 UTC
CVE-2026-103300The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and... Executive summary The Eurobank WooCommerce Payment Gateway WordPress plugin, through version 2.1.1, is affected by a flaw that lets payment-confirmation requests be accepted without checking that they really come from the payment provider. The advisory does not state a severity rating, and it says no known fix is available. Technical summary The weakness is missing verification of the origin of a payment-confirmation request, which can allow a forged confirmation to be accepted. The advisory does not state the attack vector, required privileges, or user interaction in full, and the text is truncated after the description. Affected versions are stated as through 2.1.1. No fixed version is stated, and the advisory says no known fix exists. No workaround or detection guidance is stated. The CVSS score and any evidence of exploitation in the wild are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/37851403-0765-…c2-80f6-f70d3fc34a88 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Eurobank Eurobank WooCommerce Payment Gateway Eurobank woo-payment-gateway-for-eurobank NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-103299	The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback,... Payment GatewayPayment Gateway woo-alpha-bank-payment-gateway	NVD	Oct 26 07:17 UTC
CVE-2026-103299The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback,... Executive summary The Payment Gateway WordPress plugin (woo-alpha-bank-payment-gateway) is affected by an authentication bypass flaw, according to the advisory. The advisory rates it as medium severity with a CVSS score of 5.3, and it states that no known fix is available. Technical summary The flaw is an authentication bypass (CWE-287) in which the plugin does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback. The advisory gives a CVSS score of 5.3 (medium). Affected versions are stated as through 2.2.0. The advisory states there is no known fix, so no fixed version is given. Attack vector details, required privileges, and any workarounds are not stated. Exploitation in the wild and detection guidance are not stated. The advisory also lists several unrelated plugin titles under an 'Other' section, which are not part of this plugin's description. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/0a1c3070-181d-…ea-9488-d0d7e4be419c Score No CVSS score published. Affects Payment Gateway Payment Gateway woo-alpha-bank-payment-gateway NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-103298	The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider,... CCAvenueCCAvenue Payment Gateway for WooCommerce	NVD	Oct 26 07:17 UTC
CVE-2026-103298The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider,... Executive summary The CCAvenue Payment Gateway for WooCommerce WordPress plugin, through version 3.1, is affected. The advisory says the plugin does not verify that payment-confirmation requests really come from the payment provider, and it is rated medium severity with a CVSS score of 5.3. The advisory states that no known fix is available. Technical summary The weakness is classified as CWE-284 (improper access control) and falls under OWASP A5 Broken Access Control. The plugin does not verify that a payment-confirmation request originates from the payment provider, which could let a forged confirmation be accepted. The affected version range is stated as through 3.1, and the advisory says there is no known fix. Attack preconditions, required privileges, and exploitation status are not stated. Workarounds and detection guidance are not stated. The CVSS score given is 5.3 (medium), and the vector string is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7224481a-60f8-…c2-87e9-4615ce666357 Score No CVSS score published. Affects CCAvenue CCAvenue Payment Gateway for WooCommerce NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory
	Medium	6.1	RHSA-2026:89816	kernel security update Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 8, Red Hat Enterprise Linux for IBM z Systems 8, Red Hat Enterprise Linux for Power, little endian 8, Red Hat Enterprise Linux for ARM 64 8, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10, Red Hat CodeReady Linux Builder, Red Hat kernel	Red Hat Security Advisories	Oct 26 06:57 UTC
RHSA-2026:89816CVE-2026-74515kernel security update Executive summary Red Hat Enterprise Linux 8 kernel packages are affected by one vulnerability, CVE-2026-74515, which is in the KVM s390 PCI adapter interrupt forwarding code. Red Hat rates the update as Moderate severity and recommends installing the updated kernel packages and rebooting the system. The advisory does not state a CVSS score in its text. Technical summary The flaw is described as a kernel issue in KVM s390 PCI handling, where adapter interrupt forwarding is not rejected when it is already enabled, and the advisory does not state its vulnerability class beyond this description. The advisory does not state the attack vector, preconditions, or exploitation status. The fixed version is kernel-4.18.0-553.179.1.el8_10, as listed in the package tables for the affected RHEL 8 and Extended Life Cycle 8.10 channels. The advisory does not state any workaround. Detection guidance is not stated, beyond applying the update and rebooting, and the CVSS score is referenced in the CVE page rather than given in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89816 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 Red Hat Enterprise Linux for IBM z Systems 8 Red Hat Enterprise Linux for Power, little endian 8 Red Hat Enterprise Linux for ARM 64 8 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 Red Hat CodeReady Linux Builder Red Hat kernel Red Hat Product SecurityPublished Oct 26, 2026 06:57 UTC Read the advisory
	Medium	6.3	CVE-2026-116123	A weakness has been identified in NocoDB up to 2026.07.0 NocoDBNocoDB	NVD	Oct 26 06:17 UTC
CVE-2026-116123A weakness has been identified in NocoDB up to 2026.07.0 Executive summary The NVD entry says a weakness has been identified in NocoDB, an open-source no-code database tool, in versions up to 2026.07.0. The text provided does not describe the flaw's impact or how serious it is, and it does not name a vendor fix or recommended action. Technical summary The advisory text does not state the vulnerability class, attack vector, or preconditions. It names NocoDB up to 2026.07.0 as affected but does not give a fixed version, a workaround, or detection guidance. Exploitation status and any CVSS score are not stated. The rest of the text is a copied GitHub repository page with installation instructions and project background, which does not describe the weakness. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/nocodb/nocodb Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects NocoDB NocoDB NIST National Vulnerability DatabasePublished Oct 26, 2026 06:17 UTC Read the advisory
	Medium	6.3	CVE-2026-116122	A security flaw has been discovered in NocoDB up to 2026.07.0 NocoDBNocoDB	NVD	Oct 26 06:17 UTC
CVE-2026-116122A security flaw has been discovered in NocoDB up to 2026.07.0 Executive summary A security flaw has been reported in NocoDB, an open-source no-code database platform, in versions up to 2026.07.0. The advisory text provided does not describe the flaw's impact or severity, and it contains only repository page content. Technical summary The advisory states that a security flaw exists in NocoDB up to 2026.07.0 but does not name the vulnerability class, attack vector, or preconditions. The affected version range is stated as up to 2026.07.0, and no fixed version is stated. No workaround is stated. No CVSS score, exploitation status, or detection guidance is stated. The supplied text is mostly GitHub repository page content, such as installation instructions and project description, and does not describe the flaw itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/nocodb/nocodb Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects NocoDB NocoDB NIST National Vulnerability DatabasePublished Oct 26, 2026 06:17 UTC Read the advisory
	Medium	6.3	CVE-2026-116121	A vulnerability was identified in NocoDB up to 2026.08.0 NocoDBNocoDB	NVD	Oct 26 06:17 UTC
CVE-2026-116121A vulnerability was identified in NocoDB up to 2026.08.0 Executive summary A vulnerability has been identified in NocoDB, a self-hosted database and spreadsheet platform, in versions up to 2026.08.0. The advisory text provided does not describe the severity of the flaw or the specific vendor recommendation, and the text is mostly repository page content. Technical summary The advisory text does not state the vulnerability class, attack vector, or preconditions. It does not state a CVSS score, a fixed version, a workaround, or whether exploitation has been observed. Detection guidance is not stated. The only version information given is that the affected range is up to 2026.08.0, and the text is largely a copied GitHub repository page with installation instructions rather than vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/nocodb/nocodb Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects NocoDB NocoDB NIST National Vulnerability DatabasePublished Oct 26, 2026 06:17 UTC Read the advisory
	Medium	6.3	CVE-2026-116120	A vulnerability was determined in NocoDB up to 2026.07.0 NocoDBNocoDB	NVD	Oct 26 06:17 UTC
CVE-2026-116120A vulnerability was determined in NocoDB up to 2026.07.0 Executive summary A vulnerability has been reported in NocoDB, a self-hostable no-code database platform, in versions up to 2026.07.0. The advisory text does not describe the flaw's impact or state a severity, and it gives no vendor fix or recommendation. Teams running NocoDB should check their version and watch for an official update. Technical summary The advisory text is a truncated copy of a NocoDB GitHub repository page and does not describe the vulnerability class or the affected component. The attack vector, required privileges, and user interaction are not stated. The affected range is given only as up to 2026.07.0, and no fixed version is stated. No CVSS score, workaround, exploitation status, or detection guidance is stated, so defenders should consult the NVD entry and the NocoDB project for full details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/nocodb/nocodb Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects NocoDB NocoDB NIST National Vulnerability DatabasePublished Oct 26, 2026 06:17 UTC Read the advisory
	Medium	6.1	RHSA-2026:89814	kernel-rt security update Red Hat, LinuxRed Hat Enterprise Linux, Linux kernel, Red Hat kernel-rt	Red Hat Security Advisories	Oct 26 06:05 UTC
RHSA-2026:89814CVE-2026-74515kernel-rt security update Executive summary Red Hat has released a security update for the kernel-rt real-time Linux kernel packages used on Red Hat Enterprise Linux 8 systems. Red Hat rates the issue Moderate, and its recommendation is to install the update and reboot the affected systems. Technical summary The advisory fixes CVE-2026-74515, a kernel flaw in the KVM s390 PCI code that concerns adapter interrupt forwarding when it is already enabled, and the fix rejects that case. The advisory does not state the vulnerability class, attack vector, or preconditions, and it does not give a CVSS score in the text. The fixed package is kernel-rt-4.18.0-553.179.1.rt7.520.el8_10, and a reboot is required for the update to take effect. No workaround or detection guidance is stated, and no exploitation in the wild is mentioned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89814 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H Affects Red Hat Linux Red Hat Enterprise Linux Linux kernel Red Hat kernel-rt Red Hat Product SecurityPublished Oct 26, 2026 06:05 UTC Read the advisory
	High	7.5	RHSA-2026:89753	freeipmi security, bug fix, and enhancement update Red Hat, FreeIPMIRed Hat Enterprise Linux, FreeIPMI	Red Hat Security Advisories	Oct 26 05:52 UTC
RHSA-2026:89753CVE-2026-85504CVE-2026-85505CVE-2026-85506CVE-2026-855071 morefreeipmi security, bug fix, and enhancement update Executive summary Red Hat has released a security update for the freeipmi package, which provides IPMI remote console and system management software on Red Hat Enterprise Linux 9.8 Extended Update Support and other listed Red Hat Enterprise Linux 9 variants. Red Hat rates the update as Moderate severity and six CVEs are fixed, several of which could allow arbitrary code execution. The vendor recommends applying the update to freeipmi 1.6.20 as described in its linked guidance. Technical summary The fixed flaws include stack-based buffer overflows and buffer over-reads in freeipmi's ipmi-oem handling, a Dell system info handler, and malformed Fujitsu System Event Log response parsing, with the advisory listing five CVEs as arbitrary code execution and one as denial of service. The advisory does not state the attack vector, required privileges, or preconditions for exploitation. Affected versions before the fix are not stated, and the fixed version is freeipmi-1.6.20-1.el9_8. No workaround is stated. The advisory does not state whether exploitation has been observed in the wild, and it gives no detection guidance beyond applying the package update. CVSS scores are referenced in the linked CVE pages but are not included in the text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89753 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat FreeIPMI Red Hat Enterprise Linux FreeIPMI Red Hat Product SecurityPublished Oct 26, 2026 05:52 UTC Read the advisory
	Medium	5.1	CVE-2026-116119	A vulnerability was found in NocoDB up to 2026.08.0 NocoDBNocoDB	NVD	Oct 26 05:17 UTC
CVE-2026-116119A vulnerability was found in NocoDB up to 2026.08.0 Executive summary A vulnerability was reported in NocoDB, a self-hostable no-code database platform, in versions up to 2026.08.0. The advisory text provided does not describe the flaw's impact or severity in detail, and it does not state a vendor recommendation. Technical summary The advisory text is a copy of the NocoDB GitHub repository front page and does not describe the vulnerability class, attack vector, or preconditions. It states only that a vulnerability was found in NocoDB up to 2026.08.0. Affected and fixed version details beyond that upper bound are not stated, and no workarounds, CVSS score, exploitation status, or detection guidance are given. Defenders should check the NVD entry and the vendor's security advisories for the specifics. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/nocodb/nocodb Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects NocoDB NocoDB NIST National Vulnerability DatabasePublished Oct 26, 2026 05:17 UTC Read the advisory
	Low	2.1	CVE-2026-116118	A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1 Z.aiZ.ai ZCode	NVD	Oct 26 05:17 UTC
CVE-2026-116118A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1 Executive summary A vulnerability in Z.ai Zcode, affecting versions up to 3.14.3 and 3.15.1, lets a command pass without the approval step that is meant to guard it. The advisory text is partly garbled and does not state a severity rating or a vendor recommendation. Technical summary The flaw is an approval bypass in how Zcode's Bash tool decides whether a command needs user approval. A read-only classifier (isRuntimeReadOnlyBashCommand) marks a command as read-only, and the permission service then allows it in plan and build modes without approval, even though the advisory's title refers to arbitrary file write through a sed filtering problem. The advisory names ZCode 3.14.3 and CLI 0.16.9 as affected, and its header gives the range up to 3.14.3/3.15.1. Fixed versions, workarounds, exploitation status, and CVSS score are not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from mcniyfj5bw9b.feishu.cn/docx/ZRTudN7cPoJUaZxv89ycn3rbnTG Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Z.ai Z.ai ZCode NIST National Vulnerability DatabasePublished Oct 26, 2026 05:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116117	A flaw has been found in halo-dev halo up to 2.27.0-beta.1 halo-devhalo-dev halo	NVD	Oct 26 05:17 UTC
CVE-2026-116117A flaw has been found in halo-dev halo up to 2.27.0-beta.1 Executive summary A path traversal flaw has been reported in halo-dev Halo, a content management system, in versions up to 2.27.0-beta.1. A public exploit has been published and may be used, and the advisory says the vendor did not respond to early disclosure contact. The advisory does not state a severity score or a fix. Technical summary The flaw is a path traversal in the view name resolver function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault, in application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java. It is triggered by manipulating the template argument, and the advisory says the attack may be launched remotely. A published exploit exists and may be used. The affected version range is stated as up to 2.27.0-beta.1. A fixed version is not stated, no workaround is stated, no CVSS score is stated, and no detection guidance is stated. The vendor did not respond to early disclosure contact, so an official patch may not be available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects halo-dev halo-dev halo NIST National Vulnerability DatabasePublished Oct 26, 2026 05:17 UTC Read the advisory
	High	8.5	CVE-2026-113345	Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission... Ministry of Land, Infrastructure, Transport and Tourism, JapanMinistry of Land, Infrastructure, Transport and Tourism, Japan Electronic delivery item Inspection Support System	NVD	Oct 26 05:17 UTC
CVE-2026-113345Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission... Executive summary A vulnerability in the Electronic delivery item Inspection Support System, provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism, allows files in the application's installation folder to be tampered with. The advisory says this can lead to arbitrary code execution, and it rates the flaw as high severity. The recommended action is to update to the latest version or use the latest installer provided by the developer. Technical summary The flaw is classified as incorrect default permissions (CWE-276), which is an improper file access permission issue. The advisory describes it as a local attack requiring low privileges and no user interaction, and it gives CVSS 4.0 base score 8.5 and CVSS 3.0 base score 7.8. Affected versions are Ver.4.0.36 and earlier, and the advisory does not state a specific fixed version, only that users should update to the latest version or use the latest installer. Workarounds are not stated, and no detection guidance or evidence of exploitation in the wild is given in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from jvn.jp/en/jp/JVN75668103 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Ministry of Land, Infrastructure, Transport and Tourism, Japan Ministry of Land, Infrastructure, Transport and Tourism, Japan Electronic delivery item Inspection Support System NIST National Vulnerability DatabasePublished Oct 26, 2026 05:17 UTC Read the advisory
	High	8.1	RHSA-2026:89742	python3.9 security update Red Hat, PythonRed Hat Enterprise Linux, Red Hat CodeReady Linux Builder, Red Hat Enterprise Linux for x86_64 9, Red Hat Enterprise Linux for IBM z Systems 9, Red Hat Enterprise Linux for Power, little endian 9, Red Hat Enterprise Linux for ARM 64 9, python3.9	Red Hat Security Advisories	Oct 26 04:45 UTC
RHSA-2026:89742CVE-2026-12345CVE-2026-19445CVE-2026-19553python3.9 security update Executive summary Red Hat's advisory RHSA-2026:89742 covers a security update for the python3.9 package on Red Hat Enterprise Linux 9 and several related editions and support tracks. Red Hat rates the update as Important and says it fixes three flaws, including a certificate verification bypass and a use-after-free issue. The vendor recommends applying the update, and the advisory points to Red Hat's standard update instructions. Technical summary The advisory fixes three python3.9 flaws: CVE-2026-12345, an arbitrary file deletion caused by a race condition during temporary directory cleanup; CVE-2026-19553, a certificate verification bypass from missing server_hostname validation in SSLContext.wrap_bio(); and CVE-2026-19445, a use-after-free of a server-side SSLContext when sni_callback switches contexts. The advisory does not state the attack vector or preconditions beyond these descriptions, and it does not give CVSS scores, though it says they are available on the linked CVE pages. Fixed package version is python3.9-3.9.25-7.el9_8.6 for the listed RHEL 9 and related channels. No workarounds are stated, and no detection guidance or exploitation status is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89742 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat Python Red Hat Enterprise Linux Red Hat CodeReady Linux Builder Red Hat Enterprise Linux for x86_64 9 Red Hat Enterprise Linux for IBM z Systems 9 Red Hat Enterprise Linux for Power, little endian 9 Red Hat Enterprise Linux for ARM 64 9 python3.9 Red Hat Product SecurityPublished Oct 26, 2026 04:45 UTC Read the advisory
	Medium	5.9	RHSA-2026:89746	bind9.18 security update Red HatRed Hat Enterprise Linux	Red Hat Security Advisories	Oct 26 04:40 UTC
RHSA-2026:89746CVE-2026-19662bind9.18 security update Executive summary This Red Hat advisory covers a flaw in the BIND DNS software shipped with Red Hat Enterprise Linux 9 and related products, including the Extended Update Support 9.8 releases. Red Hat rates the update as Moderate severity, and the flaw can cause a denial of service through crafted DNSSEC responses. Red Hat recommends applying the updated bind9.18 packages. Technical summary The flaw is tracked as CVE-2026-19662 and is classed by Red Hat as a denial of service caused by crafted DNSSEC responses. The advisory does not state the attack vector details, required preconditions, or a CVSS score beyond referring to the CVE page. The fixed package version is bind9.18-9.18.29-14.el9_8.11, and the advisory lists it for each affected Red Hat Enterprise Linux 9 and Extended Update Support 9.8 variant. No workaround is stated in the advisory. No detection guidance is stated, and the advisory does not say whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: ISC BIND Summarized from access.redhat.com/errata/RHSA-2026:89746 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat Product SecurityPublished Oct 26, 2026 04:40 UTC Read the advisory
	Medium	5.9	RHSA-2026:89745	bind security update Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 9, Red Hat Enterprise Linux for IBM z Systems 9, Red Hat Enterprise Linux for Power, little endian 9, Red Hat Enterprise Linux for ARM 64 9, Red Hat Enterprise Linux for x86_64 - Extended Update Support, Red Hat Enterprise Linux for IBM z Systems - Extended Update Support, Red Hat Enterprise Linux for Power, little endian - Extended Update Support, Red Hat Enterprise Linux for ARM 64 - Extended Update Support, Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions, Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions, Red Hat CodeReady Linux Builder for x86_64, Red Hat CodeReady Linux Builder for Power, little endian, Red Hat CodeReady Linux Builder for ARM 64, Red Hat CodeReady Linux Builder for IBM z Systems, Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support, Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support, Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support, Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support, Red Hat Enterprise Linux for ARM 64 - 4 years of updates, Red Hat Enterprise Linux for IBM z Systems - 4 years of updates, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle	Red Hat Security Advisories	Oct 26 04:40 UTC
RHSA-2026:89745CVE-2026-19662bind security update Executive summary Red Hat has released a security update for the bind package, which provides the BIND DNS server and related tools, on Red Hat Enterprise Linux 9 and 9.8 Extended Update Support across several hardware architectures. The advisory rates the issue Moderate and describes it as a denial of service caused by crafted DNSSEC responses. Red Hat recommends applying the updated bind packages, with details on how to do so found in its linked article. Technical summary The flaw, tracked as CVE-2026-19662, is classed in the advisory as a denial of service triggered by crafted DNSSEC responses. The advisory does not state the attack vector, required preconditions, or a CVSS score beyond referring readers to the CVE page. The fixed package version is bind-9.16.23-40.el9_8.12, and the advisory lists the affected RHEL 9 and 9.8 channels. The advisory does not state any workarounds or mitigations. It also does not state whether the flaw is being exploited in the wild, and it gives no specific detection guidance beyond applying the update. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: ISC BIND Summarized from access.redhat.com/errata/RHSA-2026:89745 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 9 Red Hat Enterprise Linux for IBM z Systems 9 Red Hat Enterprise Linux for Power, little endian 9 Red Hat Enterprise Linux for ARM 64 9 Red Hat Enterprise Linux for x86_64 - Extended Update Support Red Hat Enterprise Linux for IBM z Systems - Extended Update Support Red Hat Enterprise Linux for Power, little endian - Extended Update Support Red Hat Enterprise Linux for ARM 64 - Extended Update Support Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions Red Hat CodeReady Linux Builder for x86_64 Red Hat CodeReady Linux Builder for Power, little endian Red Hat CodeReady Linux Builder for ARM 64 Red Hat CodeReady Linux Builder for IBM z Systems Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support Red Hat Enterprise Linux for ARM 64 - 4 years of updates Red Hat Enterprise Linux for IBM z Systems - 4 years of updates Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle Red Hat Product SecurityPublished Oct 26, 2026 04:40 UTC Read the advisory
	High	7.5	RHSA-2026:89760	container-tools:rhel8 security, bug fix, and enhancement update Red HatRed Hat Enterprise Linux, Red Hat container-tools	Red Hat Security Advisories	Oct 26 04:35 UTC
RHSA-2026:89760CVE-2026-111943CVE-2026-78667container-tools:rhel8 security, bug fix, and enhancement update Executive summary Red Hat's advisory RHSA-2026:89760 updates the container-tools:rhel8 module on Red Hat Enterprise Linux 8, which provides tools such as podman, buildah, skopeo, and runc. Red Hat rates it Important and describes two Go standard library flaws, one causing denial of service through crafted HTTP Range headers and one enabling man-in-the-middle attacks through untrusted intermediate certificates. Red Hat recommends applying the updated packages described in the advisory. Technical summary The advisory lists two security fixes: CVE-2026-78667, a denial of service in net/http via crafted HTTP Range headers, and CVE-2026-111943, a man-in-the-middle issue in crypto/x509 involving untrusted intermediate certificates, both attributed to golang. The advisory does not state CVSS scores, attack preconditions, or exploitation status beyond the Important rating. Updated package versions are listed for the container-tools components, such as podman-4.9.4-38, buildah-1.33.15-2, runc-1.2.9-9, and skopeo-1.14.6-5, and the advisory's references point to a Red Hat solution article for application steps. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go golang Summarized from access.redhat.com/errata/RHSA-2026:89760 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat container-tools Red Hat Product SecurityPublished Oct 26, 2026 04:35 UTC Read the advisory
	High	8.4	CVE-2026-116116	A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36 Yoosee, Shenzhen Gwell Times Technology, Gwell TimesYoosee GM8135S Camera, Shenzhen Gwell Times Technology Yoosee GM8135S Camera, Gwell Times Yoosee Smart Camera, Grain Media GM8135S	NVD	Oct 26 04:17 UTC
CVE-2026-116116A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36 Executive summary A smart camera sold under the Yoosee name, model GM8135S with firmware 21.00.01.36 and possibly other versions, sends live video over the network without encryption, so anyone positioned on the network path can watch the stream. The advisory describes this as a zero-day with no vendor fix yet, and it recommends isolating the camera on a separate network with no outbound internet access, or replacing it with a device that encrypts traffic by default. Technical summary The advisory describes cleartext transmission of sensitive information (CWE-319), insecure default initialization (CWE-1188), and insufficient verification of data authenticity (CWE-345). An attacker on the network path can capture UDP video packets during an active live stream and reconstruct H.264 video, and the device auto-connects to open Wi-Fi SSIDs named Free-AP0 through Free-AP3 without a password, which enables proximity attacks through deauthentication. Firmware in the SPI flash is not verified, so it can be modified and reflashed, and the advisory states no authentication is needed. Affected versions are stated as up to and including 21.00.01.36, possibly others. No fixed version is stated, and the vendor has not released a firmware update. The advisory gives no detection guidance and no CVSS score is stated. Mitigations are network isolation, blocking outbound internet access, using a self-hosted NVR or TLS reverse proxy for local RTSP, and connecting the device by Ethernet. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from akosibrylle.me/writeups/yoosee-cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Yoosee Shenzhen Gwell Times Technology Gwell Times Grain Media Yoosee GM8135S Camera Shenzhen Gwell Times Technology Yoosee GM8135S Camera Gwell Times Yoosee Smart Camera Grain Media GM8135S NIST National Vulnerability DatabasePublished Oct 26, 2026 04:17 UTC Read the advisory
	Low	1.3	CVE-2026-116115	A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36 Yoosee, Gwell Times, Grain MediaYoosee GM8135S Camera, Grain Media GM8135S, Gwell Times Yoosee GM8135S Camera	NVD	Oct 26 04:17 UTC
CVE-2026-116115A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36 Executive summary A smart camera sold as the Yoosee GM8135S, with firmware version 21.00.01.36 and possibly other versions, sends live video over the network in cleartext, so a nearby or network-positioned attacker can intercept and rebuild the stream. The camera also auto-connects to open WiFi networks without a password, which makes interception easier. The advisory states that the vendor has not released a firmware update, and its recommended mitigations are to isolate the camera on a separate network, use a self-hosted secure recorder or proxy, or switch to devices that encrypt traffic by default. Technical summary The advisory classifies the issues as cleartext transmission of sensitive information (CWE-319), insecure default initialization of resources (CWE-1188), and insufficient verification of data authenticity (CWE-345). An attacker positioned on the network path or within WiFi range can capture unencrypted UDP video frames during an active live stream without authenticating to the camera. The camera automatically connects to open SSIDs named Free-AP0 through Free-AP3 with no password, and the advisory describes forcing a reconnection by deauthentication. The advisory also says the SPI flash firmware is not verified, so an attacker could modify and reflash it. Affected versions are stated as up to and including 21.00.01.36, possibly others. A fixed version is not stated, and the advisory says no firmware update has been released as of publication. Recommended workarounds are network isolation, using a secure RTSP proxy or NVR, and wiring the device by Ethernet to avoid WiFi auto-connection. No CVSS score or in-the-wild exploitation is stated, and no specific detection guidance is given beyond the sniffing setup described in the write-up. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from akosibrylle.me/writeups/yoosee-cve Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Yoosee Gwell Times Grain Media Yoosee GM8135S Camera Grain Media GM8135S Gwell Times Yoosee GM8135S Camera NIST National Vulnerability DatabasePublished Oct 26, 2026 04:17 UTC Read the advisory
	Low	2.9	CVE-2026-116114	A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36 Yoosee, Shenzhen Gwell Times Technology, Gwell Times (HK) Co., LimitedYoosee GM8135S Camera, Shenzhen Gwell Times Technology Yoosee GM8135S Camera, Grain Media GM8135S	NVD	Oct 26 04:17 UTC
CVE-2026-116114A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36 Executive summary A smart camera sold under the Yoosee name, the GM8135S Camera running firmware 21.00.01.36 and possibly other versions, sends live video over the network without encryption, so someone positioned on the network path or nearby could watch the stream. The advisory describes this as a serious privacy risk, and the vendor has not released a firmware fix; the advisory recommends isolating the camera on a separate network with no outbound internet access, using a local stream routed through a secured recorder or proxy, or replacing the device. Technical summary The advisory classifies the issues as cleartext transmission of sensitive information (CWE-319), insecure default initialization of resources (CWE-1188), and insufficient verification of data authenticity (CWE-345). The /npc/npc binary sends live UDP video frames unencrypted during an active stream, and the attacker must be able to observe traffic on the network path, which the advisory says requires no authentication on the camera. The device is also configured to auto-connect to open WiFi SSIDs Free-AP0 through Free-AP3 without a password, which the advisory says enables proximity-based interception via deauthentication. The advisory states that firmware is not verified on the SPI flash and that a telnet backdoor was set up during testing. Affected versions are stated as up to and including 21.00.01.36, possibly others. The fixed version is not stated because the vendor has not released a firmware update. Recommended workarounds are network isolation, local RTSP access with a secured proxy, and wired Ethernet connection. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from akosibrylle.me/writeups/yoosee-cve Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Yoosee Shenzhen Gwell Times Technology Gwell Times (HK) Co., Limited Grain Media Yoosee GM8135S Camera Shenzhen Gwell Times Technology Yoosee GM8135S Camera Grain Media GM8135S NIST National Vulnerability DatabasePublished Oct 26, 2026 04:17 UTC Read the advisory
	Low	2.1	CVE-2026-116113	A security flaw has been discovered in GouGuOA up to 6.1.2 GouguOAGouguOA	NVD	Oct 26 04:17 UTC
CVE-2026-116113A security flaw has been discovered in GouGuOA up to 6.1.2 Executive summary A security flaw in GouguOA, reported in version 6.1.2 and described as affecting versions up to 6.1.2, lets any logged-in employee upload a file that the server then runs as code, which can lead to full control of the server. The advisory rates the issue 8.8 High using CVSS 3.1. The advisory's remediation calls for enforcing a file type allowlist on merged uploads, moving storage out of the web root, and fixing the related code errors. Technical summary The advisory describes an unrestricted file upload (CWE-434) in the chunked upload endpoint POST /disk/api/chunkUpload, which leads to remote code execution. Any authenticated employee with a default role can exploit it, and no special privileges are required according to the advisory. The extension allowlist is applied only to chunk parts, while the merged file takes its extension from an unchecked POST parameter, so a php extension can be written under public/storage, which Apache executes as PHP. The advisory states the affected version as v6.1.2 and says earlier versions were not tested, with versions containing the same implementation presumed affected. No fixed version is stated, and the advisory gives remediation steps rather than a patched release. The advisory gives no detection beyond hunting for public/storage/*/.php and public/backup/*.sql files after patching, and it does not state a workaround other than those remediation steps. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Gum29/rrrreeeeeeee-readme/bl…rd-Vuln-Report-EN.md Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects GouguOA GouguOA NIST National Vulnerability DatabasePublished Oct 26, 2026 04:17 UTC Read the advisory
	High	7.8	RHSA-2026:89747	xorg-x11-server security update Red Hat, x.orgRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, x.org xorg-x11-server	Red Hat Security Advisories	Oct 26 03:59 UTC
RHSA-2026:89747CVE-2026-88812CVE-2026-93516CVE-2026-93517CVE-2026-935183 morexorg-x11-server security update Executive summary Red Hat has released an update for xorg-x11-server, the X Window System server, on Red Hat Enterprise Linux 8. The advisory rates the update as Important and describes multiple flaws that could allow arbitrary code execution or privilege escalation. Technical summary The advisory lists eight CVEs (CVE-2026-93516, CVE-2026-93521, CVE-2026-88812, CVE-2026-93523, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520) covering use-after-free, double-free, heap and buffer overflows, out-of-bounds writes, integer truncation, and privilege escalation via crafted RandR requests. Attack vector, required privileges, and user interaction are not stated in the advisory text. Affected package versions and fixed versions are not stated in the text provided. No workarounds or detection guidance are stated. CVSS base scores are referenced via the CVE pages but are not given in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Red Hat x.org Red Hat Enterprise Linux Red Hat Enterprise Linux 8 x.org xorg-x11-server Red Hat Product SecurityPublished Oct 26, 2026 03:59 UTC Read the advisory
	High	7.5	RHSA-2026:89754	freeipmi security, bug fix, and enhancement update Red Hat, FreeIPMIRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 8, Red Hat Enterprise Linux for IBM z Systems 8, Red Hat Enterprise Linux for Power, little endian 8, Red Hat Enterprise Linux for ARM 64 8, Red Hat CodeReady Linux Builder, FreeIPMI, Red Hat freeipmi	Red Hat Security Advisories	Oct 26 03:39 UTC
RHSA-2026:89754CVE-2026-85504CVE-2026-85505CVE-2026-85506CVE-2026-855071 morefreeipmi security, bug fix, and enhancement update Executive summary Red Hat has released a security update for the freeipmi package on Red Hat Enterprise Linux 8, which provides tools for managing servers through the Intelligent Platform Management Interface. The advisory rates the update as Moderate severity and fixes six vulnerabilities that can lead to arbitrary code execution or denial of service. The vendor recommends applying the updated freeipmi packages as described in its linked guidance. Technical summary The advisory describes stack-based buffer overflows and buffer over-reads in freeipmi, including in the ipmi-oem component, and one flaw triggered by malformed Fujitsu System Event Log responses. The impact listed includes arbitrary code execution for most issues and denial of service for CVE-2026-85505. Affected packages are freeipmi versions before 1.6.20-1.el8_10, and the fixed version is freeipmi-1.6.20-1.el8_10 across the listed RHEL 8 and CodeReady Linux Builder channels. The advisory does not state attack vector, required preconditions, or any workaround. It does not state whether exploitation in the wild has occurred, and it does not give a CVSS score in the text, referring readers to the CVE pages instead. Detection guidance is not stated beyond the update instructions at the linked Red Hat article. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89754 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat FreeIPMI Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 Red Hat Enterprise Linux for IBM z Systems 8 Red Hat Enterprise Linux for Power, little endian 8 Red Hat Enterprise Linux for ARM 64 8 Red Hat CodeReady Linux Builder FreeIPMI Red Hat freeipmi Red Hat Product SecurityPublished Oct 26, 2026 03:39 UTC Read the advisory
	High	7.5	RHSA-2026:89761	skopeo security update Red HatRed Hat Enterprise Linux, Red Hat skopeo	Red Hat Security Advisories	Oct 26 03:32 UTC
RHSA-2026:89761CVE-2025-11395CVE-2026-111943CVE-2026-78667skopeo security update Executive summary Red Hat has released a security update for skopeo, a tool for inspecting and moving container images, on Red Hat Enterprise Linux 10. Red Hat rates the update as Important and lists three vulnerabilities, including an arbitrary file write in podman, a denial of service in Go's net/http, and a man-in-the-middle issue in Go's crypto/x509. Red Hat recommends applying the updated skopeo packages listed in the advisory. Technical summary The advisory describes three CVEs: CVE-2025-11395, an arbitrary file write when importing an OCI archive in podman; CVE-2026-78667, a denial of service via crafted HTTP Range headers in the Go net/http package; and CVE-2026-111943, a man-in-the-middle issue in Go crypto/x509 involving untrusted intermediate certificates. The advisory does not state attack vectors or preconditions in detail, and it refers readers to the CVE pages for CVSS scores and impact. The fixed package is skopeo-1.22.2-6.el10_2 across the listed RHEL 10 and 10.2 variants. Workarounds, exploitation status, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: containers podman Dropped extracted product not named in the source: Go net/http Dropped extracted product not named in the source: Go crypto/x509 Summarized from access.redhat.com/errata/RHSA-2026:89761 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat skopeo Red Hat Product SecurityPublished Oct 26, 2026 03:32 UTC Read the advisory
	High	8.5	RHSA-2026:89759	libxml2 security update Red HatRed Hat Enterprise Linux, Red Hat CodeReady Linux Builder	Red Hat Security Advisories	Oct 26 03:26 UTC
RHSA-2026:89759CVE-2026-11979CVE-2026-74860CVE-2026-86138CVE-2026-861402 morelibxml2 security update Executive summary Red Hat has released an important security update for libxml2, the XML parsing library, on Red Hat Enterprise Linux 10.0 Extended Update Support and related Red Hat products. The advisory describes several flaws, including buffer overflows that could allow arbitrary code execution, and recommends applying the update. The advisory does not state a CVSS score for each flaw in the text provided. Technical summary The advisory lists several libxml2 flaws: heap and stack buffer overflows (including arbitrary code execution in the xmlcatalog utility, xmlSnprintfElements, and xmlXPtrEval), an integer overflow in write callbacks causing data integrity issues, improper parseFlags propagation leading to information disclosure, SSRF, or denial of service, and a double-free/use-after-free in the Python bindings. The advisory does not state the attack vector or preconditions in detail, and it refers readers to the CVE pages for CVSS scores. The fixed package version is libxml2-2.12.5-9.el10_0.9 for the listed Red Hat Enterprise Linux 10.0 and CodeReady Linux Builder channels. No workarounds or detection guidance are stated in the advisory, and the advisory does not state whether exploitation in the wild has occurred. Administrators should apply the update per the linked Red Hat article. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: GNOME libxml2 Summarized from access.redhat.com/errata/RHSA-2026:89759 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat CodeReady Linux Builder Red Hat Product SecurityPublished Oct 26, 2026 03:26 UTC Read the advisory
	High	7.7	RHSA-2026:89739	openssh security update Red HatRed Hat Enterprise Linux	Red Hat Security Advisories	Oct 26 03:26 UTC
RHSA-2026:89739CVE-2026-55653CVE-2026-55655CVE-2026-59995CVE-2026-599961 moreopenssh security update Executive summary Red Hat has released an openssh security update for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat rates the update as Important and says it fixes six security issues in the OpenSSH client and server. Technical summary The fixes cover several classes of flaw: a local man-in-the-middle of X11 forwarding via abstract UNIX socket pre-binding in the OpenSSH client, a double free in the DH-GEX client path during FIPS known-group validation that causes client-side denial of service, a sftp client issue that lets an attacker control the downloaded file location, a use-after-free during client-side host key re-exchange, a sshd security bypass from incorrect handling of forwarding and tunneling options, and an scp file misplacement during remote copy. The advisory does not state affected or fixed package versions, attack preconditions beyond what the titles imply, workarounds, or detection guidance. CVSS scores are referenced via the CVE pages but are not given in this text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenBSD OpenSSH Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L Affects Red Hat Red Hat Enterprise Linux Red Hat Product SecurityPublished Oct 26, 2026 03:26 UTC Read the advisory
	High	7.5	RHSA-2026:89751	grafana security update Red Hat, golangRed Hat Enterprise Linux, Red Hat grafana, golang	Red Hat Security Advisories	Oct 26 03:26 UTC
RHSA-2026:89751CVE-2026-111943CVE-2026-78667CVE-2026-78669CVE-2026-97031grafana security update Executive summary Red Hat has released a security update for the grafana metrics dashboard on Red Hat Enterprise Linux 10.2 systems, rated Important by Red Hat. The flaws are Denial of Service and Man-in-the-middle issues in the Go standard library that grafana uses, and the advisory's remedy is to install the updated packages. The advisory does not state a CVSS score in its text or known exploitation. Technical summary The advisory covers four CVEs in the Go standard library: CVE-2026-78667 (Denial of Service via crafted HTTP Range headers in net/http), CVE-2026-97031 (Denial of Service via multiple ECH outer extension references in crypto/tls), CVE-2026-78669 (Denial of Service via excessive HTTP/2 SETTINGS frames in net/http and golang.org/x/net/http2), and CVE-2026-111943 (man-in-the-middle via untrusted intermediate certificates in crypto/x509). The advisory fixes these by updating grafana to package version grafana-10.2.6-28.el10_2.8 across the listed RHEL 10 and 10.2 Extended Update Support architectures. Attack vector, preconditions, and CVSS scores are not stated in the advisory text and must be taken from the linked CVE pages. No workaround and no exploitation status are stated. Detection guidance is not stated, and the advisory names no specific indicators. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89751 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat golang Red Hat Enterprise Linux Red Hat grafana golang Red Hat Product SecurityPublished Oct 26, 2026 03:26 UTC Read the advisory
	Medium	5.5	CVE-2026-116112	A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d HashenUdaraHashenUdara edoc-doctor-appointment-system	NVD	Oct 26 03:17 UTC
CVE-2026-116112A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d Executive summary The advisory says the edoc doctor appointment system, a PHP and MySQL web application, has an unauthenticated SQL injection flaw in its admin add-new endpoint. An outside attacker could read database contents and create arbitrary doctor accounts without logging in. The advisory does not state a severity score, and it does not state a fixed version or a vendor recommendation beyond general remediation advice in the write-up. Technical summary The flaw is an unauthenticated time-based blind SQL injection in POST /admin/add-new.php, via the spec parameter, which is concatenated unquoted into an INSERT statement. The endpoint lacks effective authentication because header() redirects do not terminate script execution, so the SQL runs regardless of session state. The advisory describes the same pattern in 60+ other handlers. It notes that stacked queries are not possible through mysqli::query(), so UPDATE and DELETE are not reachable, and that the webuser INSERT hardcodes usertype 'd'. The affected version is given as commit cc258425b915d1af9e298777ccd26d160493e68d, and the advisory states that the affected version range is up to that commit. A fixed version is not stated. A workaround is not stated beyond the remediation advice to add exit after redirects and use prepared statements. Detection guidance such as log signatures or WAF rules is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/asdfghjkl12345678910111…2441cca911ecbfaa9acb Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HashenUdara HashenUdara edoc-doctor-appointment-system NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	Low	2.1	CVE-2026-116111	A vulnerability was determined in 2K Games Civilization V 1.0.3.144 2K Games2K Games Civilization V	NVD	Oct 26 03:17 UTC
CVE-2026-116111A vulnerability was determined in 2K Games Civilization V 1.0.3.144 Executive summary A proof-of-concept exploit script has been published for 2K Games Civilization V version 1.0.3.144. The advisory text provided describes a Lua bytecode exploit that would run a command on the host, and it does not state how serious the flaw is by any official rating or what the vendor recommends. Technical summary The advisory is a copied Lua exploit script (exploit.lua) that manipulates string.dump bytecode to gain control of the instruction pointer and then calls os.execute with a command (calc.exe in the sample), which suggests a memory corruption class of flaw. The advisory does not describe the attack vector, whether authentication or user interaction is required, or the precondition that a user must load or run a crafted Lua payload. Affected versions are stated only as 1.0.3.144, and no fixed version, workaround, CVSS score, or detection guidance is stated in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/drbloop2000/Sid-Meier-s-Civi…lob/main/exploit.lua Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects 2K Games 2K Games Civilization V NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116110	A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows GiantappManGiantappMan LiveWallPaper	NVD	Oct 26 03:17 UTC
CVE-2026-116110A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows Executive summary A vulnerability was reported in GiantappMan LiveWallPaper version 2.6.8.0 on Windows, a desktop wallpaper application. The advisory text does not describe the flaw's type or how serious it is, and it does not give a vendor recommendation. Defenders should check whether this application is installed and watch for a vendor fix or further details. Technical summary The advisory states only that a vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. The vulnerability class, attack vector, and required preconditions are not stated. No fixed version is stated, and no workaround is stated. No CVSS score, exploitation status, or detection guidance is stated. The rest of the text is repository page content, including branch names such as v3.x, which is not identified as affected or fixed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/GiantappMan/livewallpaper Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects GiantappMan GiantappMan LiveWallPaper NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	Low	2.1	CVE-2026-116109	A vulnerability has been found in continuedev Continue 2.0.0 continuedevcontinuedev continue	NVD	Oct 26 03:17 UTC
CVE-2026-116109A vulnerability has been found in continuedev Continue 2.0.0 Executive summary A vulnerability has been found in Continue 2.0.0, an AI coding assistant made by continuedev. The advisory says it allows operating system command injection that can be triggered remotely, and that exploit details are public. The advisory does not state a severity score, and the vendor did not respond to early disclosure contact. Technical summary The flaw is an OS command injection in the function MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts, within the MCP Server Transport component. The advisory says the attack can be executed remotely, but it does not describe the required preconditions or user interaction. The advisory states that the exploit has been disclosed and may be used. No fixed version, workaround, CVSS score, or detection guidance is stated, and the vendor did not respond to early disclosure contact. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects continuedev continuedev continue NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	High	8.5	RHSA-2026:89750	libxml2 security update Red HatRed Hat Enterprise Linux, Red Hat libxml2	Red Hat Security Advisories	Oct 26 03:12 UTC
RHSA-2026:89750CVE-2026-11979CVE-2026-6653CVE-2026-74860CVE-2026-861383 morelibxml2 security update Executive summary Red Hat has released an important-rated security update for libxml2 on Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related 9.4 channels. The advisory describes several flaws that could allow denial of service, arbitrary code execution, information disclosure, or data integrity problems when processing crafted XML. The vendor recommends applying the updated libxml2 packages. Technical summary The advisory lists eight CVEs in libxml2, including a use-after-free causing denial of service via crafted XML, buffer overflows (heap and stack) that the advisory says can lead to arbitrary code execution, an integer overflow affecting write callbacks, a parseFlags propagation issue that may cause information disclosure, SSRF, or denial of service, and a double-free or use-after-free in the Python bindings. The fixed package version is libxml2-2.9.13-13.el9_4.10 for the listed Red Hat Enterprise Linux 9.4 channels. Attack vector and preconditions beyond crafted XML input are not stated, and no workarounds or detection guidance are stated. CVSS scores are not given in the text and are referenced only through the CVE links. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: GNOME libxml2 Summarized from access.redhat.com/errata/RHSA-2026:89750 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat libxml2 Red Hat Product SecurityPublished Oct 26, 2026 03:12 UTC Read the advisory
	High	7.5	RHSA-2026:89740	rhc security update Red HatRed Hat Enterprise Linux, Red Hat rhc	Red Hat Security Advisories	Oct 26 03:10 UTC
RHSA-2026:89740CVE-2026-111943CVE-2026-78667CVE-2026-78669CVE-2026-97031rhc security update Executive summary Red Hat has released a security update for the rhc client tool on Red Hat Enterprise Linux 9.8 Extended Update Support and related RHEL 9 channels. Red Hat rates the update Important and lists four flaws, three of which allow denial of service and one of which allows man-in-the-middle attacks. The vendor recommends applying the update, and the advisory points to Red Hat's standard update instructions. Technical summary The advisory describes four flaws in the Go standard library components used by rhc: denial of service via crafted HTTP Range headers (CVE-2026-78667), denial of service via multiple ECH outer extension references in crypto/tls (CVE-2026-97031), denial of service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669), and man-in-the-middle attacks via untrusted intermediate certificates in crypto/x509 (CVE-2026-111943). The fixed package version is rhc-0.2.7-16.el9_8, and the advisory lists it for each affected RHEL 9 and 9.8 channel. The advisory does not state attack preconditions, CVSS scores, workarounds, or exploitation status, and it refers readers to the CVE pages for those details. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go Go Summarized from access.redhat.com/errata/RHSA-2026:89740 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat rhc Red Hat Product SecurityPublished Oct 26, 2026 03:10 UTC Read the advisory
	High	7.5	RHSA-2026:89755	lrzsz security, bug fix, and enhancement update Red Hat, lrzszRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, lrzsz	Red Hat Security Advisories	Oct 26 03:09 UTC
RHSA-2026:89755CVE-2026-105840CVE-2026-105841lrzsz security, bug fix, and enhancement update Executive summary Red Hat advisory RHSA-2026:89755 covers the lrzsz file transfer package on Red Hat Enterprise Linux 9 and several related subscription variants. Red Hat rates the update Important and lists two security flaws, one allowing arbitrary file overwrite and one allowing arbitrary command execution. Red Hat recommends applying the updated lrzsz packages as described in its update instructions. Technical summary The advisory describes two flaws in lrzsz. CVE-2026-105840 is an arbitrary file overwrite via absolute path traversal in restricted mode, and CVE-2026-105841 is arbitrary command execution via crafted file names in pipe mode. The advisory does not state the attack vector, required user interaction, or CVSS scores, and it refers to the CVE pages for those details. The fixed package version is lrzsz-0.12.20-58.el9_8, and the advisory does not state any workaround or detection guidance. The advisory also includes a non-security segfault fix with -s. Remediation is described at https://access.redhat.com/articles/11258. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89755 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat lrzsz Red Hat Enterprise Linux Red Hat Enterprise Linux 9 lrzsz Red Hat Product SecurityPublished Oct 26, 2026 03:09 UTC Read the advisory
	High	7.5	RHSA-2026:89744	grafana security update Red Hat, Grafana, golang.org/x/netRed Hat Enterprise Linux, golang.org/x/net/http2, Grafana	Red Hat Security Advisories	Oct 26 03:03 UTC
RHSA-2026:89744CVE-2026-111943CVE-2026-17183CVE-2026-78667CVE-2026-78669grafana security update Executive summary Red Hat's advisory RHSA-2026:89744 covers the grafana package for Red Hat Enterprise Linux 9 and fixes five security vulnerabilities, including an information disclosure flaw in Grafana Unified Alerting and several Go standard library flaws. Red Hat rated the update as having a Critical security impact. Red Hat recommends applying the updated grafana packages, and the advisory points to its standard update instructions for how to do so. Technical summary The advisory lists five CVEs: CVE-2026-17183 (information disclosure in Grafana Unified Alerting), CVE-2026-78667 and CVE-2026-78669 (denial of service via crafted HTTP Range headers and excessive HTTP/2 SETTINGS frames in net/http), CVE-2026-97031 (denial of service via multiple ECH outer extension references in crypto/tls), and CVE-2026-111943 (man-in-the-middle attacks via untrusted intermediate certificates in crypto/x509). The fixed version is grafana-10.2.6-23.el9_8.7 for the affected RHEL 9 streams. The advisory does not state the attack vector or preconditions for each flaw, does not give a CVSS score in the text (it refers to CVE pages), and does not state any workaround. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go net/http Dropped extracted product not named in the source: Go crypto/tls Dropped extracted product not named in the source: Go crypto/x509 Summarized from access.redhat.com/errata/RHSA-2026:89744 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Grafana golang.org/x/net Red Hat Enterprise Linux golang.org/x/net/http2 Grafana Red Hat Product SecurityPublished Oct 26, 2026 03:03 UTC Read the advisory
	High	7.5	RHSA-2026:89752	oci-seccomp-bpf-hook security update Red Hat, GoRed Hat Enterprise Linux, Go crypto/x509, Red Hat oci-seccomp-bpf-hook, Go net/http	Red Hat Security Advisories	Oct 26 03:01 UTC
RHSA-2026:89752CVE-2026-111943CVE-2026-56853CVE-2026-78667oci-seccomp-bpf-hook security update Executive summary Red Hat has released a security update for oci-seccomp-bpf-hook on Red Hat Enterprise Linux 10 systems. Red Hat rates the update as Important and says it fixes three flaws in Go components, including denial of service and certificate validation issues. Technical summary The advisory lists three Go standard library issues: CVE-2026-56853, a denial of service involving unencrypted HTTP/2 connections in net/http; CVE-2026-78667, a denial of service via crafted HTTP Range headers in net/http; and CVE-2026-111943, a man-in-the-middle risk from untrusted intermediate certificates in crypto/x509. The advisory refers to CVE pages for CVSS scores, attack vector details, and preconditions, which are not stated in the text itself. The fixed package is oci-seccomp-bpf-hook-1.2.11-3.el10_2 across the listed RHEL 10 and 10.2 architectures. Affected versions before the fix are not stated in the advisory. No workarounds or detection guidance are stated; the advisory points to https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89752 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Go Red Hat Enterprise Linux Go crypto/x509 Red Hat oci-seccomp-bpf-hook Go net/http Red Hat Product SecurityPublished Oct 26, 2026 03:01 UTC Read the advisory
	High	7.5	RHSA-2026:89748	libreswan security update Red Hat, LibreswanRed Hat Enterprise Linux, libreswan	Red Hat Security Advisories	Oct 26 02:43 UTC
RHSA-2026:89748CVE-2026-77206CVE-2026-77207CVE-2026-94453libreswan security update Executive summary Red Hat has released a security update for libreswan, the IPsec and IKE VPN software, for Red Hat Enterprise Linux 9.8 Extended Update Support and related RHEL 9 channels. Red Hat rates the update as Important and says it fixes three vulnerabilities. Red Hat recommends applying the updated packages, and the advisory points to a Red Hat article for update instructions. Technical summary The three flaws are an IKEv2 use-after-free when using IKE-over-TCP (CVE-2026-94453), a pre-authentication null pointer dereference in EAP code (CVE-2026-77206), and a null pointer dereference in a PKCS#7 bundle with no certificates (CVE-2026-77207). The advisory describes the affected packages as libreswan-4.15-11.el9_8, and the fixed build is libreswan-4.15-11.el9_8 as well, so no separate fixed version is given beyond this build. Attack vector details, required preconditions, and any CVSS scores are not stated in the advisory, which refers to the CVE pages for those. No workarounds or detection guidance are stated. Administrators should apply the listed package builds and verify installed versions against the SHA-256 hashes provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89748 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Libreswan Red Hat Enterprise Linux libreswan Red Hat Product SecurityPublished Oct 26, 2026 02:43 UTC Read the advisory
	High	7.5	RHSA-2026:89738	compat-openssl11 security update Red Hat, OpenSSLRed Hat Enterprise Linux, OpenSSL, Red Hat compat-openssl11	Red Hat Security Advisories	Oct 26 02:36 UTC
RHSA-2026:89738CVE-2026-63072CVE-2026-84782compat-openssl11 security update Executive summary Red Hat published security update RHSA-2026:89738 for the compat-openssl11 package on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. Red Hat rates the update as Important and describes two vulnerabilities in the OpenSSL compatibility libraries, one a heap buffer overflow and one a DTLS handshake issue. Red Hat recommends installing the updated compat-openssl11 packages. Technical summary The advisory lists two flaws: CVE-2026-63072, a heap buffer overflow in CMS key unwrapping, and CVE-2026-84782, a DTLS issue where retransmitted handshake messages are taken from a stale buffer offset. The advisory does not state attack vectors, preconditions, or CVSS scores, and it refers readers to the CVE pages for those details. Fixed package version is compat-openssl11-1.1.1k-5.el9_6.4 as listed in the package tables. No workarounds or detection guidance are stated, and no exploitation in the wild is mentioned. Update instructions point to https://access.redhat.com/articles/11258. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89738 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat OpenSSL Red Hat Enterprise Linux OpenSSL Red Hat compat-openssl11 Red Hat Product SecurityPublished Oct 26, 2026 02:36 UTC Read the advisory
	High	7.5	RHSA-2026:89741	rhc security update Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 8, Red Hat Enterprise Linux for IBM z Systems 8, Red Hat Enterprise Linux for Power, little endian 8, Red Hat Enterprise Linux for ARM 64 8, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10, Red Hat rhc	Red Hat Security Advisories	Oct 26 02:35 UTC
RHSA-2026:89741CVE-2026-111943CVE-2026-78667CVE-2026-78669CVE-2026-97031rhc security update Executive summary Red Hat has released a security update for the rhc client tool on Red Hat Enterprise Linux 8, rated Important by the publisher. The flaws are denial-of-service and man-in-the-middle issues in the Go components that rhc is built with, and Red Hat recommends applying the update described in its advisory. Technical summary The advisory lists four CVEs in Go standard library components: CVE-2026-78667 (denial of service via crafted HTTP Range headers), CVE-2026-97031 (denial of service via multiple ECH outer extension references in crypto/tls), CVE-2026-78669 (denial of service via excessive HTTP/2 SETTINGS frames), and CVE-2026-111943 (man-in-the-middle via untrusted intermediate certificates in crypto/x509). The fixed package is rhc-0.2.5-13.el8_10 for the listed RHEL 8 and RHEL 8.10 Extended Life Cycle architectures. Attack vector and preconditions beyond the descriptions are not stated, and no CVSS scores are given in the text (they are referenced via CVE pages not included here). No workarounds or detection guidance are stated; the advisory points to https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go Go standard library Summarized from access.redhat.com/errata/RHSA-2026:89741 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 Red Hat Enterprise Linux for IBM z Systems 8 Red Hat Enterprise Linux for Power, little endian 8 Red Hat Enterprise Linux for ARM 64 8 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 Red Hat rhc Red Hat Product SecurityPublished Oct 26, 2026 02:35 UTC Read the advisory
	Low	2.1	CVE-2026-116108	A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0 openbq-orgopenbq-org OpenBB	NVD	Oct 26 02:17 UTC
CVE-2026-116108A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0 Executive summary A flaw has been found in OpenBB, an investment research platform from openbq-org, affecting versions up to 4.7.2 and 5.0.0. The advisory says a public exploit has been published and may be used, and it notes the vendor did not respond to early disclosure. The advisory does not state a severity score or a fix. Technical summary The weakness is classified as improper access controls in the Local API Server component, specifically in the file openbb_platform/core/openbb_core/app/model/api_settings.py. The advisory states remote exploitation is possible and that a published exploit may be used. Affected versions are stated as up to 4.7.2/5.0.0, and no fixed version is stated. No workaround is stated, no CVSS score is stated, and no detection guidance is stated. The vendor did not respond to early disclosure, so no vendor patch or guidance is referenced. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openbq-org openbq-org OpenBB NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	Low	2.1	CVE-2026-116107	A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress DatafeedrDatafeedr Product Sets Plugin	NVD	Oct 26 02:17 UTC
CVE-2026-116107A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress Executive summary A flaw in the Datafeedr Product Sets Plugin for WordPress, in versions up to 1.3.24, lets someone perform an action they should not be allowed to perform. The advisory says a public exploit exists and recommends upgrading to version 1.3.25. Technical summary The weakness is missing authorization in the dfrps_ajax_delete_saved_search function in functions/ajax.php, part of the AJAX Handlers component. The advisory says the attack may be launched remotely and that an exploit is public. It does not state what privileges or user interaction are required, what impact beyond the missing check is possible, or any CVSS score. Affected versions are up to and including 1.3.24, and the fixed version is 1.3.25. The advisory does not state any workaround or detection guidance. It states the vendor was contacted early about the disclosure. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Datafeedr Datafeedr Product Sets Plugin NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	Medium	6.9	CVE-2026-116106	A security vulnerability has been detected in HeyCyan App 1.0.103 on Android HeyCyan, AgoraHeyCyan App	NVD	Oct 26 02:17 UTC
CVE-2026-116106A security vulnerability has been detected in HeyCyan App 1.0.103 on Android Executive summary The advisory covers the HeyCyan companion app for Glass Studio smart glasses, version 1.0.103 on Android. The author reports 21 vulnerabilities, 3 rated critical, and calls the overall risk critical, with an aggregate CVSS of 9.1 for a chain that combines network interception and WebView code execution. The recommended response is a prioritized fix list, starting with removing cleartext HTTP traffic, fixing the file provider root path, and removing the JavaScript bridge. The source is a partial reconstruction from search cache, so parts of the original report are missing. Technical summary The report describes cleartext HTTP allowed globally, a FileProvider exposing the application root path, a WebView with a JavaScript interface that can lead to code execution, exported components, unencrypted SQLite user data, missing certificate pinning, mutable PendingIntents, and world-readable SharedPreferences. The main chain needs an attacker on the same WiFi network to perform a man-in-the-middle attack and inject JavaScript, while the file provider issue is described as reachable by any app on the device. The affected version is stated as 1.0.103 (build code 103), and no fixed version is stated. The advisory gives remediation steps such as removing usesCleartextTraffic, removing the root-path provider entry, removing addJavascriptInterface, adding FLAG_IMMUTABLE, and adding SQLCipher, but it does not describe a vendor patch or a workaround that is confirmed as effective. Detection guidance is not stated, and exploitation in the wild is not stated. The author performed static analysis only and no dynamic testing. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: VideoLAN VLC Summarized from github.com/ohackercego/heycyan-vulnerabilitys Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HeyCyan Agora HeyCyan App NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	Medium	6.3	CVE-2026-116105	A weakness has been identified in HeyCyan App 1.0.103 on Android HeyCyan, VLC, AgoraHeyCyan App, HeyCyan, VLC libvlc, Agora RTC/RTM	NVD	Oct 26 02:17 UTC
CVE-2026-116105A weakness has been identified in HeyCyan App 1.0.103 on Android Executive summary A partial, reconstructed report from a GitHub repository describes 21 security weaknesses in the HeyCyan Android companion app (version 1.0.103) for Glass Studio smart glasses. The report rates the overall risk as critical, mainly because a chain of issues involving unencrypted network traffic and a WebView JavaScript bridge could allow remote code execution and theft of user data. The advisory does not state a fixed version, and its recommendations are to remove cleartext traffic, fix the file provider and WebView bridge, and secure the other listed weaknesses. Technical summary The report lists three critical findings: HTTP cleartext traffic allowed globally (V1, CVSS 9.1), a FileProvider exposing the root path (V2, CVSS 8.4), and an insecure WebView with a JavaScript bridge (V3, CVSS 8.8). The main chain requires an attacker on the same WiFi network to perform a man-in-the-middle attack, inject JavaScript into an HTTP response, call @JavascriptInterface methods, and read local files through file://, with a local FileProvider reading path also listed. Other weaknesses include missing certificate pinning, mutable PendingIntents, world-readable SharedPreferences, an unencrypted Room database, exported components, and an unverified OTA firmware channel. The advisory does not state affected version ranges beyond 1.0.103, fixed versions, or any exploitation in the wild, and it gives no vendor-issued patch. Workarounds are given only as recommended fixes in the report's roadmap, such as removing usesCleartextTraffic, removing addJavascriptInterface, adding FLAG_IMMUTABLE, and using SQLCipher. The report provides no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ohackercego/heycyan-vulnerabilitys Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HeyCyan VLC Agora HeyCyan App HeyCyan VLC libvlc Agora RTC/RTM NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	High	8.8	RHSA-2026:89733	flatpak security update Red Hat, flatpakRed Hat Enterprise Linux, flatpak, Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6, Red Hat Enterprise Linux Server - AUS 9.6, Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6, Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6, Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6, Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6, Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6, Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6, Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6, Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6	Red Hat Security Advisories	Oct 26 02:12 UTC
RHSA-2026:89733CVE-2026-90616CVE-2026-96275CVE-2026-96280CVE-2026-96808flatpak security update Executive summary Red Hat published advisory RHSA-2026:89733 for the flatpak package, which is used to build, distribute, and run sandboxed desktop applications on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. Red Hat rates the update Important and lists four security flaws that can lead to code execution or privilege escalation. Red Hat recommends applying the flatpak update described in the advisory. Technical summary The advisory lists four flaws in flatpak: missing symlink protection leading to arbitrary code execution (CVE-2026-90616), extra-data extraction giving arbitrary write access as root (CVE-2026-96275), a buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280), and local privilege escalation via symlink traversal in the revokefs writer (CVE-2026-96808). The fixed package version is flatpak-1.12.9-4.el9_6.5, as written in the advisory. The advisory does not state CVSS scores in the text provided, attack preconditions beyond the descriptions above, workarounds, or exploitation in the wild, and it refers readers to the CVE pages and to https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89733 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat flatpak Red Hat Enterprise Linux flatpak Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 Red Hat Enterprise Linux Server - AUS 9.6 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 Red Hat Product SecurityPublished Oct 26, 2026 02:12 UTC Read the advisory
	High	7.5	RHSA-2026:89736	compat-openssl11 security update Red Hat, OpenSSLRed Hat Enterprise Linux, OpenSSL, OpenSSL compat-openssl11	Red Hat Security Advisories	Oct 26 02:04 UTC
RHSA-2026:89736CVE-2026-63072CVE-2026-84782compat-openssl11 security update Executive summary Red Hat published an Important-rated security update for the compat-openssl11 package on Red Hat Enterprise Linux 9.4 systems, including Update Services for SAP Solutions, 4 years of updates, and Extended Life Cycle channels. The update fixes two OpenSSL flaws, one a heap buffer overflow in CMS key unwrapping and one a DTLS handshake retransmission issue. Red Hat recommends applying the updated packages, and the advisory points to its update instructions. Technical summary The advisory describes CVE-2026-63072, a heap buffer overflow in CMS key unwrapping, and CVE-2026-84782, a DTLS issue where retransmitted handshake messages are taken from a stale buffer offset. The advisory does not state the attack vector, required preconditions, or CVSS scores, and points to the CVE pages for those details. The fixed package is compat-openssl11-1.1.1k-5.el9_4.4 across the listed RHEL 9.4 channels. The advisory does not state any workaround or mitigation, and it gives no detection guidance or information on exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89736 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat OpenSSL Red Hat Enterprise Linux OpenSSL OpenSSL compat-openssl11 Red Hat Product SecurityPublished Oct 26, 2026 02:04 UTC Read the advisory
	High	7.5	RHSA-2026:89737	compat-openssl11 security update Red Hat, OpenSSLRed Hat Enterprise Linux, OpenSSL	Red Hat Security Advisories	Oct 26 01:58 UTC
RHSA-2026:89737CVE-2026-63072CVE-2026-84782compat-openssl11 security update Executive summary Red Hat published an Important security update for the compat-openssl11 package on Red Hat Enterprise Linux 9.2 systems, including Update Services for SAP Solutions, Extended Life Cycle, and related channels. The advisory fixes two OpenSSL flaws, a heap buffer overflow in CMS key unwrapping and a DTLS handshake retransmission issue, and Red Hat recommends applying the updated packages. The advisory does not state a CVSS score for either flaw in the text provided. Technical summary The advisory describes CVE-2026-63072, a heap buffer overflow in CMS key unwrapping, and CVE-2026-84782, a DTLS flaw where retransmitted handshake messages are taken from a stale buffer offset. The advisory does not state the attack vector, exploitation preconditions, or whether either flaw is exploited in the wild. The fixed package version is compat-openssl11-1.1.1k-4.el9_2.3, and the vulnerable prior versions are not stated. No workaround or detection guidance is stated, and the advisory directs readers to https://access.redhat.com/articles/11258 for how to apply the update. CVSS scores are referenced to the CVE pages and are not given in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89737 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat OpenSSL Red Hat Enterprise Linux OpenSSL Red Hat Product SecurityPublished Oct 26, 2026 01:58 UTC Read the advisory
	High	7.5	RHSA-2026:89732	grafana security update Red Hat, GrafanaRed Hat Enterprise Linux, Grafana, Red Hat Enterprise Linux for x86_64 10	Red Hat Security Advisories	Oct 26 01:46 UTC
RHSA-2026:89732CVE-2026-17183CVE-2026-94440grafana security update Executive summary Red Hat has released a security update for grafana, the open source metrics dashboard, on Red Hat Enterprise Linux 10. Red Hat rates the update as Important and says it fixes an information disclosure flaw in Grafana Unified Alerting and a denial of service flaw in the Go net/textproto and mime/multipart packages. The recommended action is to apply the grafana package update listed in the advisory. Technical summary The advisory describes two fixes: CVE-2026-17183, an information disclosure vulnerability in Grafana Unified Alerting, and CVE-2026-94440, a denial of service caused by a memory limit bypass in multipart form parsing in the Go net/textproto and mime/multipart packages. The advisory does not state the attack vector, required privileges, or CVSS scores, and refers readers to the CVE pages for those details. The fixed package is grafana-10.2.6-28.el10_2.9, and the advisory lists its SHA-256 checksums for each architecture. No workarounds or detection guidance are stated, and exploitation in the wild is not stated. Vendor-specific update steps are referred to https://access.redhat.com/articles/11258. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go net/textproto Dropped extracted product not named in the source: Go mime/multipart Summarized from access.redhat.com/errata/RHSA-2026:89732 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Grafana Red Hat Enterprise Linux Grafana Red Hat Enterprise Linux for x86_64 10 Red Hat Product SecurityPublished Oct 26, 2026 01:46 UTC Read the advisory
	High	7.5	RHSA-2026:89734	jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Red Hat, FasterXMLRed Hat Enterprise Linux, FasterXML jackson-core, Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6, FasterXML jackson-databind, FasterXML jackson-jaxrs-providers, FasterXML jackson-modules-base	Red Hat Security Advisories	Oct 26 01:46 UTC
RHSA-2026:89734CVE-2026-68497CVE-2026-91777jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Executive summary Red Hat advisory RHSA-2026:89734 fixes two denial-of-service flaws in the Jackson Java JSON libraries, shipped in Red Hat Enterprise Linux 9.6 Extended Update Support and related RHEL 9.6 subscriptions. Red Hat rates the update Important. Red Hat recommends applying the updated jackson packages listed in the advisory. Technical summary The advisory covers two denial-of-service flaws in jackson-databind: CVE-2026-68497, a CPU denial of service via unbounded numeric parsing, and CVE-2026-91777, a denial of service via quadratic forward-reference completion. The advisory does not state the attack vector, required privileges, or user interaction. Fixed package versions are listed as jackson-core-2.21.6-1.el9_6, jackson-databind-2.21.6-1.el9_6.1, jackson-jaxrs-providers-2.21.6-1.el9_6, and jackson-modules-base-2.21.6-1.el9_6, along with pki-jackson packages. No CVSS score is given in the text, and it refers to the CVE pages for details. No workarounds or detection guidance are stated. Administrators should apply the update using the article referenced in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89734 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat FasterXML Red Hat Enterprise Linux FasterXML jackson-core Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 FasterXML jackson-databind FasterXML jackson-jaxrs-providers FasterXML jackson-modules-base Red Hat Product SecurityPublished Oct 26, 2026 01:46 UTC Read the advisory
	High	7.5	RHSA-2026:89730	libX11 security update Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 8, Red Hat Enterprise Linux for IBM z Systems 8, Red Hat Enterprise Linux for Power, little endian 8, Red Hat Enterprise Linux for ARM 64 8, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10	Red Hat Security Advisories	Oct 26 01:43 UTC
RHSA-2026:89730CVE-2026-88806libX11 security update Executive summary A security update for libX11, the core X11 client library, is available for Red Hat Enterprise Linux 8 systems. Red Hat rates the issue as Important and says it is a heap-based buffer overflow that can be triggered through a malicious X server. Red Hat recommends applying the updated libX11 packages, version 1.6.8-10.el8_10, as described in its update instructions. Technical summary The flaw is tracked as CVE-2026-88806 and is classified as a heap-based buffer overflow in libX11 triggered via a malicious X server. The advisory does not state the attack preconditions beyond a malicious X server, and it does not give a CVSS score in the text provided, referring instead to the CVE page. The fixed package version is libX11-1.6.8-10.el8_10 across the listed Red Hat Enterprise Linux 8 and Extended Life Cycle 8.10 architectures. The advisory does not state any workaround or mitigation, nor any detection guidance, and it does not state whether the issue is being exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: X.Org libX11 Summarized from access.redhat.com/errata/RHSA-2026:89730 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 Red Hat Enterprise Linux for IBM z Systems 8 Red Hat Enterprise Linux for Power, little endian 8 Red Hat Enterprise Linux for ARM 64 8 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 Red Hat Product SecurityPublished Oct 26, 2026 01:43 UTC Read the advisory
	Low	2.1	CVE-2026-116104	A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0 SonySony Neural Network Libraries, Sony NNabla	NVD	Oct 26 01:17 UTC
CVE-2026-116104A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0 Executive summary A code injection flaw affects Sony NNabla Neural Network Libraries up to version 1.39.0. Converting a malicious model file can run attacker-chosen commands on the machine doing the conversion, and the advisory rates it High with a CVSS v3.1 score of 8.8. The advisory states that the project is end of life and no upstream fix is expected, so it recommends not converting .nnp files from untrusted sources until a patched fork exists. Technical summary The flaw is CWE-94 code injection: the NNP converter passes the attacker-controlled function.type field into Python eval() calls in func_set_nnabla_version_decorate (utils.py lines 111 and 116). A duplicate network name lets a malicious second network bypass the version gate, which only checks the first same-name network. Exploitation requires the victim to run nnabla_cli convert on a crafted .nnp file (network attack vector, user interaction required, no privileges). The advisory states that the affected version is 1.39.0 and that the earliest affected version is unknown, and it gives no fixed version because the project is EOL. Recommended fixes are replacing eval() with getattr/hasattr, validating function.type against known types, and enforcing unique network names. The advisory does not state any detection guidance, and no vendor advisory is listed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/3em0/cve_repo/blob/main/2026…n-in-NNP-Converter-('function.type'-eval()).md Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Sony Sony Neural Network Libraries Sony NNabla NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-116103	A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 SonySony Neural Network Libraries, Sony Neural Network Libraries (nnabla)	NVD	Oct 26 01:17 UTC
CVE-2026-116103A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 Executive summary Sony Neural Network Libraries (nnabla) up to and including v1.39.0 contains a code injection flaw in its command-line parameter encoder. An attacker who supplies a malicious parameter directory can run arbitrary operating system commands when a victim runs the documented encode_param command, and the advisory says this happens without any visible error. The advisory rates the issue High under CVSS v3.1 with a score of 8.8, and states that the project is end-of-life so no upstream patch is expected, with the workaround being to avoid processing parameter directories from untrusted sources. Technical summary The flaw is CWE-95 eval injection: the first line of each .txt parameter file is passed to Python's eval() without validation in load_param_in_txt() in encode_decode_param.py at line 37, reachable through nnabla_cli encode_param. Exploitation requires the victim to run the command on an attacker-supplied directory (CVSS AV:N, PR:N, UI:R, AC:L), and the advisory's proof of concept shows the canary command completing with exit code 0. Affected versions are stated as all versions up to and including v1.39.0, and the advisory says vulnerable code remains on the master branch; no fixed version is stated because the project is end-of-life and no upstream patch is expected. The suggested remediation is to replace eval() with ast.literal_eval() plus integer validation, and the stated workaround is to never run encode_param or decode_param on untrusted directories. The advisory gives no detection guidance beyond the proof of concept, and it does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/3em0/cve_repo/blob/main/2026…)-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Sony Sony Neural Network Libraries Sony Neural Network Libraries (nnabla) NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116102	A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0 QuantGeekDevQuantGeekDev docker-mcp	NVD	Oct 26 01:17 UTC
CVE-2026-116102A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0 Executive summary A command injection flaw has been reported in the docker-mcp project by QuantGeekDev, affecting versions 0.1.0 and 0.2.0. The advisory says the flaw can be triggered remotely, and it does not state a severity score or a vendor recommendation. Technical summary The flaw is an OS command injection in the _build_windows_command function of docker_executor.py, triggered by manipulating the project_name argument. The advisory states the attack can be started remotely. Affected versions are listed as 0.1.0/0.2.0. Fixed versions are not stated. Workarounds are not stated. Exploitation in the wild is not stated. Detection guidance is not stated, and no CVSS score is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects QuantGeekDev QuantGeekDev docker-mcp NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-116101	A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 26 01:17 UTC
CVE-2026-116101A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 Executive summary A SQL injection flaw has been reported in the Online Cake Ordering System version 1.0 from itsourcecode. An attacker could potentially read, change, or disrupt the application's database, and the advisory describes the risk as serious. The advisory recommends using prepared statements, validating user input, limiting database account permissions, and running regular security audits; it does not state a vendor-issued fix. Technical summary The flaw is an SQL injection in the id parameter of /deletetransac.php, which the advisory says fails to sanitize or validate input before it is used in SQL queries. The proof of concept is a GET request with a crafted id value that uses GTID_SUBSET error-based injection against the host 154.219.114.125:9012. The advisory is inconsistent about preconditions: the root cause text says the attacker must log in with valid credentials, while the POC section says no authentication is required and exploitation does not require prior access. Affected version is listed as V1.0. A fixed version is not stated, no CVSS score is stated, and exploitation in the wild is not stated. The suggested repairs are prepared statements, input validation, minimal database permissions, and security audits; no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/RyanCarter9527/submit/issues/1 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	1.9	CVE-2026-116100	A vulnerability has been found in gougucms up to 4.08.18 GouguCMSGouguCMS	NVD	Oct 26 01:17 UTC
CVE-2026-116100A vulnerability has been found in gougucms up to 4.08.18 Executive summary A stored cross-site scripting flaw has been reported in GouguCMS up to version 4.08.18, affecting its user level management feature. An administrator account can save malicious script as a user level name, which then runs in the browser of any administrator who views the list. The advisory does not state a severity rating or a vendor fix, so the recommended response is not stated. Technical summary This is a stored cross-site scripting (XSS) vulnerability in the user level function of GouguCMS v4.08.18, in app/admin/controller/Level.php and related files. An authenticated administrator can submit HTML or JavaScript in the title parameter, which is stored in cms_user_level.title without output encoding and rendered as HTML in the admin user-level list. The advisory provides a proof-of-concept POST request to /admin/level/add that sets the title to a script tag, and notes the same value also appears in the user list via /admin/user/index. The advisory does not state a fixed version, a workaround, a CVSS score, or whether exploitation has been observed in the wild. Detection guidance beyond the reproduction steps is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/yuhuixiaowu/cve/blob/main/go…ucms_v4.08.18_XSS.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects GouguCMS GouguCMS NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-116099	A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 Fusion Creators StudioFusion Creators Studio SCP Containment Breach Multiplayer	NVD	Oct 26 00:17 UTC
CVE-2026-116099A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 Executive summary A flaw has been reported in Fusion Creators Studio SCP Containment Breach Multiplayer, affecting versions up to 1.295. The advisory text describes a buffer overflow that could allow remote code execution, and it links to a public exploit repository. The advisory does not state a severity rating, and no vendor fix or recommendation is provided in the text. Technical summary The advisory describes a buffer overflow vulnerability that allows arbitrary remote code execution. The stated preconditions are subscribing to a malicious addon on the workshop or connecting to a server that runs the RCE addon, and then playing the game. The affected version is stated as up to 1.295 in the title, and no fixed version is stated. No workaround, CVSS score, or vendor patch guidance is stated. Detection guidance is not stated, and the referenced repository includes a proof-of-concept exploit file named Exploit.gs. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/drbloop2000/SCP-CBM-RCE/tree/main Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Fusion Creators Studio Fusion Creators Studio SCP Containment Breach Multiplayer NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116098	A vulnerability was detected in SteelRaven7 Ravenfield 25407073 SteelRaven7SteelRaven7 Ravenfield	NVD	Oct 26 00:17 UTC
CVE-2026-116098A vulnerability was detected in SteelRaven7 Ravenfield 25407073 Executive summary The advisory reports a vulnerability in SteelRaven7 Ravenfield, but the text provided is a Steam Community web page and contains no description of the flaw itself. The severity and vendor recommendations are not stated. Technical summary The advisory text only says a vulnerability was detected in SteelRaven7 Ravenfield 25407073, followed by boilerplate Steam Community page content. The vulnerability class, attack vector, and preconditions are not stated. Affected and fixed versions are not stated beyond the version string 25407073 shown in the title. No workaround, detection guidance, CVSS score, or evidence of exploitation is stated. Defenders should consult the NVD entry and the vendor for technical details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from steamcommunity.com/app/636480/events/590690402783479125 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SteelRaven7 SteelRaven7 Ravenfield NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Low	2.1	CVE-2026-116097	A security vulnerability has been detected in CloudClassroom-PHP-Project CloudClassroom-PHP-ProjectCloudClassroom-PHP-Project, CloudClassroom-PHP-Project addnewstudent.php	NVD	Oct 26 00:17 UTC
CVE-2026-116097A security vulnerability has been detected in CloudClassroom-PHP-Project Executive summary A stored cross-site scripting flaw affects CloudClassroom-PHP-Project version 1.0 and prior, in the addnewstudent.php and studentdetails.php components. The advisory rates it Medium with a CVSS score of 6.1 and says the product is unpatched with no fix available yet. The advisory's recommended mitigations are output encoding, input validation, restricting access to the affected component, and reviewing sessions and credentials. Technical summary The flaw is stored (persistent) cross-site scripting (CWE-79) in addnewstudent.php, where the fname, lname, faname, addrs and course fields are saved without sanitization and echoed back without HTML encoding, and the name is rendered unencoded in studentdetails.php. The advisory states that no authentication is needed to inject the data, that a victim admin or faculty user must view the record (user interaction required), and that the attack is remote over the network via POST. Affected versions are listed as 1.0 (and prior), and the fixed version is listed as None. The advisory gives workarounds: htmlspecialchars encoding with ENT_QUOTES, input validation, Content-Security-Policy, prepared statements, network ACLs and WAF rules, and session invalidation. It provides log search indicators for suspicious values such as script, onerror, onload and svg tags. It does not state a CVE identifier, an official vendor response, or any evidence of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vinniboy021-blip/Advisory/bl…tudent-stored-xss.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects CloudClassroom-PHP-Project CloudClassroom-PHP-Project CloudClassroom-PHP-Project addnewstudent.php NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Low	1.9	CVE-2026-116096	A weakness has been identified in ggml-org llama.cpp ggml-orgggml-org llama.cpp	NVD	Oct 25 23:17 UTC
CVE-2026-116096A weakness has been identified in ggml-org llama.cpp Executive summary The advisory describes a weakness in ggml-org llama.cpp, a C/C++ library for running large language models. The text provided is mostly repository content and does not describe the weakness, its severity, or a vendor fix, so these points are not stated. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It does not list affected or fixed versions, workarounds, CVSS score, or exploitation status. The only identifiable reference is to the llama.cpp master branch repository page, which is not a version statement. Defenders should consult the NVD entry at the provided URL or the upstream project's security policy for the specific details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ggml-org/llama.cpp Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ggml-org ggml-org llama.cpp NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116095	A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 smg-projectsmg-project smg	NVD	Oct 25 23:17 UTC
CVE-2026-116095A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 Executive summary The advisory describes a flaw in smg-project smg versions 1.7.0 through 1.10.1 that appears to involve a crafted JPEG image causing excessive memory allocation. The advisory text is mostly a copied GitHub gist page and does not state a severity rating or a fixed version. No vendor recommendation is stated in the text provided. Technical summary The advisory text is a copied gist page containing a proof-of-concept Python script that writes JPEG files declaring dimensions of 65500x65500 and 20000x20000, which the script says would require a large byte allocation in a decoder, and PNG control files. The vulnerability class is not explicitly stated, though the script comments suggest resource exhaustion through image dimension handling. The attack vector and preconditions are implied to be supplying a crafted image to the affected software, but this is not explicitly stated. Affected versions are listed as 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1, and fixed versions, workarounds, CVSS score, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects smg-project smg-project smg NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116094	A vulnerability was determined in EyouCMS up to 1.8.3 EyouCMSEyouCMS	NVD	Oct 25 22:16 UTC
CVE-2026-116094A vulnerability was determined in EyouCMS up to 1.8.3 Executive summary A vulnerability was reported in EyouCMS up to version 1.8.3, a content management system. The advisory describes a server-side request forgery flaw that can be triggered from the public site, but it does not state a severity rating. Technical summary The advisory describes server-side request forgery caused by a missing SSRF check in the remote_file_to_local() function, which can be reached from the front end. It states the affected range as up to 1.8.3, but no fixed version is stated. Attack preconditions, CVSS score, and exploitation in the wild are not stated. No workaround is stated. No detection guidance is stated; the text mainly consists of repository file listings and references to a reproduction document and vulnerability report that are not included here. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/yy-t1/security-reports/tree/…9%8D%E5%8F%B0%20SSRF Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects EyouCMS EyouCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 22:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115635	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115635Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... Executive summary A flaw in AshPostgres, a database library used with the Ash framework, can let one tenant read another tenant's record in a multi-tenant application. The advisory rates it MEDIUM with a CVSS 4.0 base score of 6.0. The advisory points to a fix in version 2.15.2 and the fix commit 8aa8122, and it does not state any workaround. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the ash_postgres data layer. When an upsert is skipped during Ash.bulk_create/4 or a single create with return_skipped_upsert?: true, the lookup of the existing row did not apply attribute multitenancy, so a user could receive another tenant's record that shares the same identity values. The advisory says the affected range is from 2.6.22 before 2.15.2 on Hex, and from commit af0903f up to commit 8aa8122 on GitHub. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, which requires low privileges and a resource that uses attribute multitenancy with return_skipped_upsert?: true. The advisory does not state any workaround or in-the-wild exploitation, and it gives no specific detection guidance beyond the affected routines. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-115635.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115627	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115627Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... Executive summary A flaw in the ash_postgres library, used with the Elixir Ash framework, lets a user in one tenant see records that belong to other tenants' data when certain relationships are loaded. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The advisory states the affected range is from 0.38.0 before 2.15.2 on Hex, and the fix is in commit 8c25c94 on GitHub; it does not explicitly state an upgrade recommendation beyond that fix. Technical summary This is an Incorrect Authorization flaw (CWE-863) where AshPostgres builds lateral join queries for many_to_many and through relationships without running the resource's read action, so attribute multitenancy is not applied to the join resource. The attack requires an authenticated user with low privileges (PR:L) and network access, and the preconditions are that the join resource uses :attribute multitenancy with rows from several tenants and that the relationship is loaded with a lateral join, such as with a limit, offset or sort. The advisory states the affected Hex versions as 0.38.0 up to but not including 2.15.2, and the GitHub affected range as commit 7115bec up to but not including 8c25c94. A workaround is not stated in the advisory. Detection guidance is not stated beyond the affected function names lateral_join_query/3, through_step_queries/4 and run_query_with_lateral_join/4 in lib/data_layer.ex. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-115627.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-114214	Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... ash-projectash-project ash	NVD	Oct 25 20:16 UTC
CVE-2026-114214Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... Executive summary A flaw in the Ash framework, an Elixir library from ash-project, lets a client read destination records that should only be reachable through a specific relationship. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The vendor's fix is in version 3.37.1, and the advisory says affected versions are 3.24.0 before 3.37.1. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the Ash read relationships code, specifically lateral_join?/4 in lib/ash/actions/read/relationships.ex. When a has_many through relationship is loaded for a single record with a limit of 1, or an unsorted has_one through relationship is loaded with a limit of 1, the query omits the filter linking destination records to the source, so the load returns unrelated records; paging with an offset can enumerate more of them. The attack vector is network with low complexity, and the CVSS vector requires low privileges and no user interaction, with high confidentiality impact. The advisory states the affected range as 3.24.0 up to but not including 3.37.1, with fix commit e374633, and says the vulnerable Git range is 24f41e2 to e374633. The advisory does not state a workaround or any detection guidance, and does not state whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-114214.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Low	2.0	CVE-2026-116063	A weakness has been identified in DedeCMS up to 5.7.118 DedeCMSDedeCMS	NVD	Oct 25 18:16 UTC
CVE-2026-116063A weakness has been identified in DedeCMS up to 5.7.118 Executive summary A remote code execution weakness has been reported in DedeCMS up to version 5.7.118, a content management system. The advisory rates it 7.2 under CVSS v3.1 base and 8.8 for the other listed score, and it lists a code injection flaw in the update guide script. Technical summary The advisory describes a code injection flaw in dede/update_guide.php that can lead to remote code execution, mapped to CWE-94, CWE-96, and CWE-352. The table lists CVSS v3.1 scores of 7.2 / 8.8 without stating which score is the base score, and it does not state the attack vector, required privileges, or user interaction in plain terms. The advisory does not state a fixed version, a workaround, or any detection guidance. It also does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/SDshadow/cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects DedeCMS DedeCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116062	A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116062A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker can exploit it without logging in to read, change, or delete database data. The advisory does not state a severity rating, a fixed version, or a vendor patch. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/save_profile.php, where user input is placed directly into SQL queries without validation. The advisory describes it as time-based blind and says no login or authorization is required. The affected version is listed as V1.0, and no fixed version is stated. No workaround is stated beyond the suggested repair of using prepared statements with parameter binding, strict input validation, least-privilege database accounts, and regular audits. The advisory gives no detection guidance, no CVSS score, and does not say whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/13 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116061	A vulnerability was identified in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116061A vulnerability was identified in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents. The advisory does not state a vendor fix or official severity score, and it recommends using prepared statements, input validation, least-privilege database accounts, and regular security audits. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/edit_dealer.php, which the advisory says is passed directly into SQL queries without validation. The advisory describes it as time-based blind injection, reproduced with sqlmap, and says no login or authorization is required. The affected version is listed as V1.0; a fixed version is not stated. No workaround beyond the suggested code fixes (prepared statements, input validation, minimal database permissions) is given, and no CVSS score or detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/12 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116060	A vulnerability was determined in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 17:17 UTC
CVE-2026-116060A vulnerability was determined in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker who needs no login could read, change, or delete database data and potentially disrupt the service. The advisory does not state a severity score or a vendor fix, and it recommends prepared statements, input validation, and least-privilege database accounts. Technical summary The flaw is a SQL injection in the 'contact' parameter of /opils/staff/adddealer.php, reached through a multipart/form-data POST request. The advisory states no login or authorization is required, and it describes a time-based blind variant that was confirmed with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor patch, workaround beyond the suggested code fixes, CVSS score, or exploitation in the wild is stated. The suggested repair is to use prepared statements with parameter binding, validate and filter input, restrict database account privileges, and run regular security audits. The advisory gives no specific detection guidance such as log signatures. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/11 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115825	HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... HTTP::Server::PSGIHTTP::Server::PSGI	NVD	Oct 25 17:17 UTC
CVE-2026-115825HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... Executive summary HTTP::Server::PSGI for Perl, in versions before 1.0056, can be crashed by a single request that declares a very large Content-Length. The advisory describes the impact as the server dying with an out-of-memory error on Linux. The advisory points to a code change that caps body reads at 64 KiB, and the fixed release is named as the version that includes that change. Technical summary The flaw is a resource exhaustion issue: the request body was read with sysread() using the full remaining Content-Length, so Perl tried to grow the buffer to that size before reading and failed with "Out of memory!" on Linux. The attack vector is a single crafted HTTP request sent to the server, with no authentication stated as required. The advisory says versions before 1.0056 are affected and the patch caps reads at 64 KiB (CVE-2026-115825 is referenced in the commit), but a specific fixed version number beyond the 1.0056 threshold is not stated. Workarounds are not stated, and no detection guidance is given. CVSS score and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/plack/Plack/commit/11545871c…9cfeb4ebc1069a.patch Score No CVSS score published. Affects HTTP::Server::PSGI HTTP::Server::PSGI NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115824	Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115824Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... Executive summary Starman, a Perl web server, has a flaw that lets an attacker exhaust server memory by sending chunked request bodies that the server keeps buffering without limit. The advisory does not state a severity rating or CVSS score. The fix is included in version 0.4019, and the advisory indicates the patch is available in the repository. Technical summary The advisory describes unbounded buffering of chunked request bodies in the chunk decoder, which can cause memory exhaustion, and the commit message also describes a quadratic-backtracking regex in chunk-size line parsing (CVE-2026-115822) that consumes CPU. The attack requires sending crafted chunked HTTP requests to a Starman server; the advisory does not state authentication or other preconditions. Affected versions are stated as those before 0.4019, and the fixed version is 0.4019. The fix replaces the regex with index() and an anchored parser, limits chunk-size lines to 4096 bytes, rejects sizes over 13 hex digits with 400 and closes the connection, and makes _prepare_env return an error status so bad bodies are not dispatched. No workarounds are stated, and no detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/0f33…71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115823	Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115823Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... Executive summary Starman, a Perl web server, sends response bodies for HEAD requests and for 1xx, 204 and 304 responses, which can cause response desynchronization on keep-alive connections. The advisory does not state a severity rating or an exploitation status, and the fix is in Starman versions 0.4019 and later. Technical summary The flaw is a response desynchronization issue (HTTP response smuggling class) in Starman before 0.4019 for Perl, where bodies are written for HEAD, 1xx, 204 and 304 responses even though those responses must not carry a body. On keep-alive or pipelined connections, the extra bytes are read as the start of the next response, and a front end that pools upstream connections can be affected. The advisory does not state a CVSS score, attack preconditions beyond keep-alive or pipelined connections, or a workaround. The fix is in commit 91c47c529cd1e100f938486896ea9083ec3ec7bf, which skips body output for these responses and closes object bodies without reading them, and it adds a test file t/no_body_response.t. Detection guidance is not stated, and the advisory names no specific fixed release beyond the version threshold of 0.4019. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/91c4…ea9083ec3ec7bf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115822	Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115822Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... Executive summary The advisory says Starman, a Perl web server, is affected by a flaw that lets a remote sender exhaust CPU on the server by sending chunked request bodies with long runs of hex digits. The advisory does not give a severity rating or CVSS score. The vendor-side fix is a code change that rejects malformed or overly long chunk-size lines with a 400 error, and the advisory says versions before 0.4019 are affected. Technical summary The flaw is a regular expression backtracking problem (quadratic complexity, a form of algorithmic CPU exhaustion) in parsing the chunk-size line of chunked request bodies, which the commit message says ran again over the whole buffer after every read. The attacker needs only to send an HTTP request with Transfer-Encoding: chunked; the advisory says 32 KiB of input cost about 1.7 seconds of worker CPU. The fix bounds chunk-size lines to 4096 bytes, parses them with an anchored linear-time pattern, rejects sizes with more than 13 significant hex digits, and returns 400 and closes the connection on malformed input. The advisory states affected versions as before 0.4019, but it does not state a fixed version number explicitly, and no workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/0f33…71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115817	Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115817Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... Executive summary Starman, a Perl web server, has a flaw where a client that sends a request body and then stalls can keep a server worker busy indefinitely, which can exhaust workers with only a few connections. The advisory describes the severity only in terms of workers being taken; a CVSS score is not stated. The fix adds a total time limit for reading request bodies, and the advisory's guidance is to update Starman to a release at or after 0.4019 (the fixed version is stated as 0.4019 in the advisory's wording of affected versions before 0.4019). Technical summary The weakness is a resource exhaustion issue (missing timeout on request body reads): read_timeout applied only to request headers, so a Content-Length or chunked body could stall or trickle indefinitely. The attack requires only network access to the Starman listener and a few open connections to tie up workers, and no authentication is mentioned. Affected versions are stated as before 0.4019 and the fix adds a --body-timeout option (body_timeout, default 300 seconds, 0 disables) that responds with 408 Request Timeout and closes the connection. The advisory does not state a CVSS score, a CWE, exploitation in the wild, or detection guidance beyond the timeout behavior, and it recommends a reverse proxy that buffers request bodies as a mitigation. Workaround details beyond setting body_timeout are not otherwise stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/89df…15586ba2588558.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116058	A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 AlfrescoAlfresco Activiti	NVD	Oct 25 16:16 UTC
CVE-2026-116058A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 Executive summary A vulnerability has been reported in Alfresco Activiti, a workflow product, affecting versions up to 7.21.0-rc.692. The advisory says it can be exploited remotely to inject code, and the vendor did not respond when contacted about it. The advisory does not state a severity score or a fix. Technical summary The flaw is described as code injection in the JuelScriptEngine.eval function of JuelScriptEngine.java, which is reached by performing a manipulation that the advisory does not specify. The attack can be initiated remotely. The advisory does not state any required privileges or user interaction, and it does not state a CVSS score. The advisory affects versions up to and including 7.21.0-rc.692, and no fixed version is stated. No workaround or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Alfresco Alfresco Activiti NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116057	A vulnerability has been found in KodCloud KodExplorer up to 4.55 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116057A vulnerability has been found in KodCloud KodExplorer up to 4.55 Executive summary KodCloud KodExplorer, a web-based file manager, is affected by a vulnerability in versions up to 4.55. The advisory says the flaw can be exploited remotely and that exploit details are public, but it does not state a severity score. The advisory does not state any vendor-recommended fix, and the vendor did not respond to early disclosure. Technical summary The flaw is an unrestricted upload issue in the Online Editor Save Endpoint, located in app/controller/editor.class.php, where manipulation of the path/filestr argument is reported. It can be attacked remotely, and the advisory says an exploit has been publicly disclosed and may be used. Affected versions are stated only as up to 4.55, and no fixed version is stated. No workaround, detection guidance, CVSS score, or authentication requirement is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116056	A flaw has been found in KodCloud KodExplorer up to 4.56 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116056A flaw has been found in KodCloud KodExplorer up to 4.56 Executive summary A flaw has been found in KodCloud KodExplorer, a file management product, up to version 4.56. The advisory describes it as a server-side request forgery issue that can be triggered remotely. The vendor did not respond when contacted about the disclosure, and no fix or vendor recommendation is stated. Technical summary The flaw is server-side request forgery in the request_url_safe function of app/function/web.function.php, within the Remote Download component. An attacker can trigger it remotely by manipulating input to that function. The advisory states affected versions as up to 4.56 but does not state any fixed version. No workaround, exploitation status, CVSS score, or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116055	A vulnerability was detected in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 15:17 UTC
CVE-2026-116055A vulnerability was detected in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw was reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents and disrupt the service. The advisory does not state a fixed version or a vendor patch, and it recommends code fixes such as prepared statements and input validation. Technical summary The flaw is SQL injection in the 'id' parameter of /opils/admin/deleteproduct.php, where user input is placed directly into SQL queries without validation. The advisory states that no login or authorization is required, and it provides a POST request example. Boolean-based blind and time-based blind techniques were demonstrated with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor workaround is stated beyond the suggested remediation of parameterized queries, input filtering, least-privilege database accounts, and security audits. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/5 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	Low	1.2	CVE-2026-116054	A security vulnerability has been detected in SH3 SH3SH3 Módulo de Gestão/Módulo de Arrecadação	NVD	Oct 25 15:17 UTC
CVE-2026-116054A security vulnerability has been detected in SH3 Executive summary A weakness has been reported in SH3, a product whose Gestão and Arrecadação management modules are affected. The advisory says the flaw is hard to exploit remotely, but a public exploit has been disclosed and may be used. The vendor's recommendation is to upgrade the affected component to version 2026.0.2.0. Technical summary The flaw is classified as a password hash computed with insufficient computational effort, which weakens protection of stored credentials if an attacker obtains the hashes. The attack can be carried out remotely, but the advisory says it is highly complex and rated difficult to exploit. A public exploit has been disclosed. The advisory states that upgrading to version 2026.0.2.0 mitigates the issue; it does not state the vulnerable version range. No workaround, CVSS score, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SH3 SH3 Módulo de Gestão/Módulo de Arrecadação NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	High	8.8	CVE-2026-116211	YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116211YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... Executive summary YesWiki versions from 4.5.0 before 4.7.0 contain an SQL injection flaw in the Bazar entry creation feature, where a date field from the request is inserted into a database query without escaping. The advisory rates it High with a CVSS score of 8.2 and says the fix is in version 4.7.0, so users should upgrade to 4.7.0 or later. Technical summary The flaw is CWE-89 SQL injection in PageManager::save(), where the date_maj_fiche POST field is concatenated raw into an INSERT SET statement via the forcedDate parameter instead of being escaped like the other columns. The advisory describes a network attack with low complexity and no privileges required on the authenticated path, and says an unauthenticated path via action=saisir_fiche works on a default install, with confidentiality impact rated High. Affected versions are stated as >= 4.5.0, < 4.7.0 in the package data and <= 4.6.7 in the description, and the patched version is 4.7.0. The advisory suggests escaping $forcedDate at the sink or validating date_maj_fiche as a strict datetime, but does not state any other workaround. Detection guidance is not stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-wjf7-hrf3-9gcx Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-116208	YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116208YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... Executive summary YesWiki, a wiki package used with ActivityPub federation, has a missing authorization flaw in its sync feature. A malicious federated server can cause a YesWiki administrator's routine sync to delete, overwrite, or create entries that belong to other federated actors. The advisory rates it High (8.1 CVSS) and states the fix status is not fixed, with the affected range given as versions 4.6.2 through 4.6.7; the advisory does not state a patched version for the sync path. Technical summary The flaw is CWE-862 (missing authorization) in ActivityPubService::syncActorPosts, which processes Delete, Update, and Create activities from a remote outbox without the assertOwns() and sameHost() checks used by the inbox handler, and runs a host-scoped garbage-collection delete. Exploitation requires an administrator to trigger the sync action (a GET request with no CSRF token), and the attacker needs no privileges on the wiki; the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The advisory lists the affected range as >= 4.6.2 and <= 4.6.7 in the body, while the metadata says '< 4.7.0' and the patched version is listed as 4.7.0, but it also says the fix status is 'not fixed' for the sync path. Workarounds are stated as avoiding sync with untrusted actors and adding a CSRF token to the sync action, which the advisory suggests but does not confirm as implemented. No detection guidance is stated, and no exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-cr64-h6xp-9g2j Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.8	CVE-2026-116207	YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116207YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() Executive summary YesWiki, a wiki platform, has a critical flaw that lets anyone on the network read data from its database, including user credentials, without logging in. It can also be used to make the site unavailable by overloading the database. The advisory recommends updating to 4.7.0 or 5.0.0-alpha4, and restricting network access to the public Bazar entries API until then. Technical summary The flaw is an unauthenticated SQL injection (CWE-89) in the Bazar entries search API, reachable through GET /api/forms/{formId}/entries and /api/entries/bazarlist. A backtick in the query or searchfields field name breaks out of a backtick-quoted SQL alias, because the code uses mysqli_real_escape_string, which does not escape backticks. Injected SELECT subqueries can read any table the database user can access, and results are returned in the JSON response, while SLEEP-based subqueries can exhaust database connections. The advisory states the vector is network with low complexity and no privileges or user interaction, and gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H with a score of 9.1. Fixed versions are stated as 4.7.0 and 5.0.0-alpha4, while the affected range is inconsistently described as 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 in one place and as 4.6.7 through 5.0.0-alpha3 in the detailed text. Recommended interim mitigation is restricting network access to the public Bazar endpoints. Detection guidance is not stated, and no in-the-wild exploitation is mentioned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-ccp2-6q93-hggh Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116206	YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116206YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... Executive summary YesWiki, a wiki package distributed through Composer, has a stored cross-site scripting flaw affecting versions from 4.2.0 up to but not including 4.7.0. The advisory rates it Moderate (CVSS 6.4) and says any logged-in user who can comment on a page can run scripts in the browsers of everyone who views that page, including administrators. The advisory lists 4.7.0 as the patched version, but its body says no fix exists in any published release, so administrators should confirm the status with the vendor before relying on an upgrade. Technical summary The flaw is CWE-79 stored cross-site scripting in comment bodies. Comments are saved with only whitespace trimming and are rendered with the Twig raw filter, and the wiki raw-HTML syntax is enabled by default through allow_raw_html set to true, so any authenticated user with comment access on a page can inject script through POST /api/comments. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, and the advisory says no user interaction beyond viewing the page is needed. The header lists affected versions as >= 4.2.0, < 4.7.0 and patched version as 4.7.0, but the body says the confirmed affected range is >= 4.2.0, <= 4.6.7 and that the fix status is not fixed. The advisory suggests sanitizing comment bodies at storage or setting allow_raw_html to false as an interim step, but it does not state a fixed release that the body confirms. No detection guidance or indicators of exploitation in the wild are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-wq96-vjjh-hfc6 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	6.9	CVE-2026-116205	YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116205YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... Executive summary YesWiki versions before 4.7.0 contain an unauthenticated server-side request forgery flaw. Any anonymous visitor can make the YesWiki server fetch arbitrary internal or external URLs and read the responses back. The advisory rates it Moderate with a CVSS 3.1 base score of 5.3, and the fix is to upgrade to version 4.7.0. Technical summary The flaw is CWE-918 server-side request forgery in the wiki raw-inclusion syntax [[\|URL]], which fetches attacker-supplied URLs without scheme, host, or IP validation and echoes the response body. It is reachable without authentication through the page render handler using the content parameter, and also stored via a page body saved by a registered editor that fires when anonymous visitors view it. The advisory states the affected versions are less than 4.7.0 and the patched version is 4.7.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. A workaround is not stated, and no detection guidance beyond the proof of concept's access log observation is provided. No CVE ID is listed in the advisory, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-x9j5-r988-9jcc Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-116204	YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116204YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or... Executive summary YesWiki, a wiki package distributed through Composer, has a cross-site request forgery flaw in its admin despam action. An unauthenticated attacker who gets a logged-in administrator to view a planted wiki page could permanently delete pages or restore old revisions, with the front page and configuration pages at risk. The advisory rates it High (CVSS 8.1) and recommends adding CSRF token checks, but it contradicts itself on which versions are fixed. Technical summary The flaw is CWE-352 in tools/security/actions/despam.php, where the destructive clean (suppr[]) and revision-restore (rev[]) branches are guarded only by a session-based UserIsAdmin() check, with no CSRF token, Origin, or Referer verification. The advisory describes the attack as requiring default configuration (default_write_acl='*', allow_raw_html=true), an attacker-created wiki page containing an auto-submitting form, and an administrator visiting that page; the session cookie's SameSite=Lax setting still allows the same-site POST. Affected versions conflict within the advisory: the header lists affected versions as before 4.7.0 with patched version 4.7.0, while the body states a confirmed affected range of <= 4.6.8 and says the fix status is not fixed. The advisory also says the v5 pre-release 5.0.0.0-alpha3 is affected, though it is outside the stable range it scopes. The stated CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H with a base score of 8.1. Recommended fixes are to require a CSRF token on the clean and revision-restore branches, with CSP script-src and form-action 'self' and a permissions.action entry for despam as defense-in-depth. Detection guidance and exploitation in the wild are not stated, and the advisory notes no CVE is assigned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-cv88-hx5q-vq72 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116203	YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116203YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding Executive summary YesWiki versions before 4.7.0 contain a stored cross-site scripting flaw in the filtertags action. An anonymous visitor who can create or edit a page could store script that runs for every later viewer of that page. The advisory rates it High and says the fix is to upgrade to version 4.7.0. Technical summary The flaw is stored cross-site scripting (CWE-79) in the filtertags action, where attacker-controlled token values are echoed into page HTML without output encoding, including the button inner text, the title parameter, and the tagbadges value. The payload is injected through the action attribute syntax, which the wakka formatter processes before its allow_raw_html check, so it bypasses that control. Preconditions stated are that default page ACLs on a fresh install are read=* and write=*, and the advisory reports anonymous exploitation using a hashcash token fetched without authentication. Affected versions are stated as before 4.7.0 and the patched version as 4.7.0. The advisory does not state a workaround. It recommends output-encoding the echo sites in tools/tags/actions/filtertags.php. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-f53x-3gqx-xq76 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.1	CVE-2026-116202	YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116202YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar... Executive summary A stored cross-site scripting flaw in YesWiki lets a low-privilege authenticated user upload a malicious SVG file through an image field, and the script runs for people who open the entry or the stored file. The advisory says the earlier fix for a related form-upload issue did not cover this image field, so the flaw remains on the patched version. The advisory lists the affected version as before 4.7.0 and the patched version as 4.7.0, and it recommends applying the same upload sanitization to the image field. Technical summary This is a stored cross-site scripting issue (CWE-79) caused by unrestricted SVG upload through the ImageField class in tools/bazar/fields/ImageField.php, which stores files without the sanitizer that the sibling FileField class received in the earlier fix. The attacker needs a valid authenticated account (PR:L) and user interaction (UI:R), and posts a multipart request to /api/entries/{formId} with an SVG file that is then served as image/svg+xml on the wiki origin. The advisory states the affected versions as less than 4.7.0 and the patched version as 4.7.0, and it says the fix for this specific field is not yet present. No workaround is stated. No detection guidance is stated beyond the proof-of-concept description. The advisory does not state any exploitation in the wild or a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-c5q6-7233-3v6g Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-116201	Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116201Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... Executive summary Snipe-IT versions before 8.5.0 contain a flaw that lets an attacker reuse a captured SAML login assertion to obtain multiple valid sessions for the same user. The advisory rates the severity as Moderate and says the fix is in version 8.5.0. Technical summary This is a race condition (TOCTOU, CWE-367) in the SAML assertion nonce check, enabling capture-replay (CWE-294). The nonce check and insert were not atomic and the saml_nonces.nonce column had a non-unique index, so two concurrent POST /saml/acs requests with the same captured assertion could both log in. Affected versions are stated as <= 8.4.1 and the patched version is 8.5.0, with fixes in commit 5b0a779c07 and a unique index migration that runs saml:clear_expired_nonces first. Preconditions are SAML SSO enabled with valid IdP metadata, an attacker holding one valid assertion, and the ability to submit it twice within a sub-second race window. No workaround is stated. Exploitation in the wild is not stated, and no CVE ID is listed (the advisory says No known CVE). Specific detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-w49g-f2jc-qxhg Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.2	CVE-2026-116200	Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116200Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds Executive summary Snipe-IT versions up to and including 8.6.2 can send LDAP login credentials, including the service account password and end-user passwords, in cleartext when an attacker on the network path interferes with the encrypted connection setup. The advisory rates the issue Moderate and recommends upgrading to version 8.6.3 or later, which fixes the flaw. Technical summary The flaw is a cleartext transmission of sensitive information issue (CWE-319) caused by an algorithm downgrade during negotiation (CWE-757). In Ldap::connectToLdap(), the return value of ldap_start_tls() was ignored, so when StartTLS failed, the code still performed an ldap_bind() in cleartext. Exploitation requires LDAP authentication enabled with ldap_tls = 1, and an attacker on the network path between Snipe-IT and the LDAP server, who answers the StartTLS request with a Protocol error or the server does not offer StartTLS. Affected versions are stated as <= 8.6.2 and the patched version is 8.6.3, fixed in commit 91ea06904f. The advisory does not state any workaround. It does not state whether exploitation has occurred in the wild, and no CVSS score is given. No detection guidance is provided beyond the stated exploitability conditions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-wx48-r3qh-jvh5 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Critical	9.2	CVE-2026-116199	Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116199Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... Executive summary A flaw in Snipe-IT, an IT asset management application, lets users who have been deactivated sign in through Google single sign-on if their Google account is still active. The advisory rates it Moderate and says it affects versions 8.6.2 and earlier. The vendor recommends upgrading to version 8.6.3 or later. Technical summary The Google SSO callback in GoogleAuthController::handleGoogleCallback looks up the local user by username matching the Google account email and logs them in without checking the activated flag, which is a missing authorization check (CWE-285) and an improper authentication weakness (CWE-287). The advisory says exploitation requires Google SSO to be enabled, a deployment that uses email-as-username or an email-shaped username on the account, a deactivated account, and a still-live Google identity. Affected versions are stated as 8.6.2 and earlier, and the fix is in 8.6.3 (commit 5fea2fadc0), which checks the activated flag after lookup. The advisory does not state a CVE ID, a CVSS score, or any workaround other than upgrading. It does not state whether exploitation has been observed in the wild, and it gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-xf36-wx48-5rqp Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116198	Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116198Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... Executive summary Snipe-IT versions 8.6.3 and earlier have a flaw in the API asset-creation path that can store sensitive custom field values as plaintext when the caller lacks the permission needed to write encrypted fields. The advisory rates the issue Low and says it is fixed in version 8.7.0, which the vendor recommends installing. Technical summary The flaw is classified as missing encryption of sensitive data (CWE-311) and an always-incorrect control flow implementation (CWE-670) in Api\AssetsController::store. When the caller lacks assets.view.encrypted_custom_fields, the encryption call is skipped and the unencrypted value is written to the database column because the block lacks a continue statement, unlike the update path. The advisory states the affected versions are 8.6.3 and earlier and the fixed version is 8.7.0, with the fix in commit 34dafe9eed. The advisory does not state a CVE ID, a CVSS score, or any workaround. It also does not state whether exploitation has been observed or provide specific detection guidance beyond the description of the impact. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-jh4g-98fm-jcqc Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Low	2.1	CVE-2026-116197	Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over... edgelesssys, Edgeless Systemsedgelesssys contrast, Edgeless Systems Contrast	NVD	Oct 25 14:17 UTC
CVE-2026-116197Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over... Executive summary Edgeless Systems Contrast versions from 1.21.0 before 1.25.0 contain a flaw in the imagepuller component that can select the wrong registry configuration when both a concrete domain and its parent wildcard are configured. The advisory rates it Low, with a CVSS v3.1 base score of 2.6, and the vendor's fix is to upgrade to 1.25.0 or later. Technical summary The flaw is classified as CWE-1289, improper validation of unsafe equivalence in input, in the imagepuller registry selection logic. It is exploitable only when the registry pull configuration contains both a concrete domain (for example registry.example.com) and its parent domain as a wildcard (for example .example.com), which the advisory describes as very unlikely in practice. The advisory lists affected versions as 1.21.0 through 1.24.1 and the patched version as 1.25.0, with the fix made in pull request #2682. The CVSS v3.1 vector is AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, giving a score of 2.6. The advisory states a workaround: replace the wildcard entry with a list of concrete entries. No detection guidance is stated, and no CVE identifier is stated (the advisory says No known CVE). Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/edgelesssys/contrast/securit…/GHSA-w4p9-c7h8-jvgr Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects edgelesssys Edgeless Systems edgelesssys contrast Edgeless Systems Contrast NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	6.0	CVE-2026-116196	Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... rclone, Backblazerclone, Backblaze B2	NVD	Oct 25 14:17 UTC
CVE-2026-116196Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... Executive summary Rclone, an open-source tool for copying and syncing files to cloud storage, has a credential exposure flaw in its Backblaze B2 backend. When a custom download host is configured, the live account authorization token and SSE-C encryption keys can be sent over cleartext or to another host during an HTTP redirect, and the advisory rates it Moderate with a CVSS 3.1 base score of 5.3. The advisory says the fix is to update to v1.75.2, with workarounds that include enforcing HTTPS on the download URL and using least-privilege application keys. Technical summary This is a cleartext transmission of sensitive information issue (CWE-319) in the rclone b2 backend, where the default Go HTTP client follows redirects from the custom --b2-download-url host. A same-host HTTPS-to-HTTP redirect causes the Authorization header to be resent in cleartext, and the SSE-C customer key headers are forwarded to any redirect target host. The advisory lists rclone versions before v1.75.2 and states affected versions as <= v1.75.0 with patched version v1.75.2. The attack vector is Adjacent with high complexity, no privileges or user interaction required, and CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The Remediation section says to update to v1.75.1, which conflicts with the patched version v1.75.2 listed elsewhere in the advisory. Workarounds are to enforce an explicit https:// scheme on --b2-download-url, block plaintext redirects at the CDN, unset the download URL, and use scoped application keys. No CVE identifier is stated in the advisory, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-gpw7-77cq-9f72 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone Backblaze rclone Backblaze B2 NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.0	CVE-2026-116195	Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... rclone, github.com/rclone/rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116195Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... Executive summary A flaw in the rclone file sync tool lets an attacker who can create a specially named directory in the source tree change ownership and timestamps of a directory outside the destination the operator chose. The advisory rates it Moderate, with a CVSS score of 7.4 for the root-run case and a conservative estimate of about 6.8. The advisory recommends fixing the trimming logic so the name is checked after trimming, and it notes the affected versions are 1.75.1 and earlier, with 1.75.2 as the patched version. Technical summary This is a path traversal (CWE-22, CWE-59) in rclone's local backend, where translateLink trims the .rclonelink suffix from the OS path after the containment check, so validated paths can be shifted one directory up. It requires a local destination with -l and --metadata, and an attacker who can create a directory named .rclonelink in the copied tree. The advisory reports the escape affects metadata only (ownership, timestamps, xattrs) because content writes are blocked by os.Root hardening, and that a root-run case allows ownership change. It lists affected versions as <= 1.75.1 and patched version 1.75.2, but also states that v1.75.0 and master HEAD 4479a3b are affected by its own testing. The suggested fix is to trim the remote name before confinement and re-validate the final path. The advisory does not state a workaround, and it does not state any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-55qp-jrwr-x827 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone github.com/rclone/rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116194	Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... rclone, pCloudrclone, pCloud backend	NVD	Oct 25 14:16 UTC
CVE-2026-116194Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... Executive summary Rclone versions from 1.52.0 before 1.75.2 contain a cross-site request forgery flaw in the pCloud backend's localhost OAuth setup callback. A malicious web page open in a user's browser during the pCloud authorization flow can silently point the user's pCloud remote at an attacker-controlled host, causing later file transfers to go to that host. The advisory rates it Moderate with a CVSS score of 6.8, and the fix is to upgrade to v1.75.2. Technical summary The flaw is a missing state check (CWE-352 cross-site request forgery) on rclone's localhost OAuth callback at 127.0.0.1:53682 for the pCloud backend, combined with trust in an unauthenticated hostname parameter (CWE-346). An attacker needs a victim to load a malicious page while rclone config or rclone authorize pcloud is running, and the advisory notes Chrome Private Network Access can block subresource requests while top-level navigation is not blocked. Affected versions are stated as >= 1.52.0 and <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround. Detection guidance beyond the proof of concept is not stated, and no CVE identifier is listed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-hvpr-p4pv-4f46 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone pCloud rclone pCloud backend NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116193	Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116193Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests Executive summary The advisory says rclone, an open-source file synchronization tool, has an authentication bypass in its serve webdav feature affecting versions from 1.64.0 before 1.75.2. An unauthenticated remote attacker can learn whether arbitrary paths exist and whether they are files or folders, though file contents and writes are not reachable. The advisory rates it Moderate with a CVSS v3 base score of 5.3 and recommends upgrading to 1.75.2. Technical summary The flaw is missing authentication (CWE-306) caused by the basicAuth and MiddlewareAuthCustom HTTP middlewares in lib/http skipping all OPTIONS requests rather than only genuine CORS preflights. An unauthenticated network attacker can send OPTIONS requests to rclone serve webdav and read the Allow header, which differs for existing files, existing collections, and missing paths, enabling namespace enumeration. The advisory states the affected range as >= 1.64.0 and <= 1.75.1, with patched version 1.75.2. No workaround is stated. The advisory does not state whether the issue is exploited in the wild, and it gives no detection guidance beyond the proof of concept. The advisory says rclone serve http and other listed servers are not affected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-gj73-fh6v-92fj Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116192	rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116192rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... Executive summary Rclone versions from 1.37 before 1.74.2 contain a server-side request forgery flaw that lets unauthenticated attackers, when the optional --rc-serve feature is enabled without RC authentication, redirect HTTP and NetStorage backend requests to hosts they choose. The advisory rates it Moderate with a recommended CVSS 3.1 score of 5.9. The vendor-side fix is to upgrade to version 1.74.2, which the advisory lists as the patched version. Technical summary This is a server-side request forgery (CWE-918) caused by a scheme-relative named-remote root, such as //host/path, that replaces the configured URL authority for the http and netstorage backends. Exploitation requires --rc-serve enabled, no RC HTTP authentication, a reachable RC listener, and knowledge of an existing http or netstorage remote name; the advisory notes the default bind is loopback and that --rc-no-auth is not set in the tested configuration. Affected versions are stated as 1.37 or later up to and including 1.74.1, with patched version 1.74.2. The advisory says the attacker can cause same-scheme HEAD and GET requests to attacker-selected hosts with response bodies returned, send configured HTTP headers to those hosts, and obtain time-bound NetStorage signatures, but no write primitive is demonstrated. A proposed origin-check patch is described, but the advisory does not state a workaround, and no detection guidance is given. Whether the issue is exploited in the wild is not stated, and no CVE identifier is listed on the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-xqmq-v4wj-rw5m Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116191	Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... rclone, ncwrclone, ncw rclone	NVD	Oct 25 14:16 UTC
CVE-2026-116191Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... Executive summary Rclone versions before 1.75.2 contain a path traversal flaw in its WebDAV server (rclone serve webdav) that lets an unauthenticated remote client create, overwrite, and move files and directories above the folder that rclone is configured to serve. The advisory rates it High with a CVSS 3.1 base score of 7.5, and it describes the impact as integrity and availability rather than data disclosure. The vendor's fix is upgrading to version 1.75.2. Technical summary The flaw is a CWE-22 path traversal caused by unvalidated '..' path elements in WebDAV requests, such as MKCOL /. which plants a directory node whose backend path is '..'. The attack needs no authentication, which the advisory says is the default for rclone serve webdav, and requires two HTTP requests (an MKCOL followed by a PUT). The advisory says it applies when the served remote has a non-empty root and the backend joins root and remote before encoding, such as webdav, ftp, sftp, http, or memory, and that local and s3 backends are not affected. Affected versions are stated as <= 1.75.1 and the patched version as 1.75.2; the advisory says the lower bound is not established. Workarounds stated: running with --read-only blocks the attack (the advisory reports MKCOL returning 405), and the advisory proposes code fixes that add path checks. Detection guidance beyond the proof-of-concept request sequence is not stated, and no CVE identifier is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-44pm-2q5p-fm63 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116190	rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116190rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... Executive summary The rclone tool's WebDAV backend can send a custom credential header to a different host when the configured WebDAV server issues a cross-host redirect, which could expose a reusable login credential. The advisory rates it Low, with a CVSS 3.7 score and a note that no CVE is assigned. The advisory states that affected versions are v1.56.0 through v1.75.1 and that v1.75.2 is the patched version. Technical summary This is an information disclosure flaw, classified as CWE-200 and CWE-522, in which operator-configured custom headers set via the WebDAV headers option are re-sent on cross-host HTTP 3xx redirects. Exploitation requires that an attacker can influence the server's redirect response, such as through an open redirect, a malicious or compromised endpoint, or an on-path position on a cleartext or same-host hop. The advisory states the fixed version is v1.75.2 and that the default configuration is affected, independent of the auth_redirect option. Standard Authorization headers are stripped by Go across registrable domains, but custom-named headers are not. The advisory does not state a workaround beyond avoiding reusable secret headers on remotes that may redirect to other hosts, and it does not state any detection guidance or known exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-3rqf-7h69-gg5v Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.7	CVE-2026-116189	rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116189rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... Executive summary A flaw in the stable self-update feature of rclone, a command-line file sync tool, lets an attacker who already controls the trusted release download path install a malicious replacement program, affecting versions 1.55.0 through 1.75.1. The advisory rates the issue High, with a CVSS 3.1 score of 7.5. The advisory recommends applying the proposed fix, which resolves the checksum only from the signed portion of the response, but it states that no upstream fixed release was available at the time of testing and the listed patched version is 1.75.2. Technical summary The vulnerability is an improper verification of a cryptographic signature (CWE-347). The verifier checks a PGP clearsigned SHA256SUMS block but then looks up the archive hash in the original response buffer, which can include unsigned bytes before the signed block, so an attacker-supplied unsigned checksum line is accepted. The attack requires control of authenticated responses from the stable release distribution path, such as origin, CDN, or TLS termination compromise, or interception with a trusted certificate, and user interaction in running stable selfupdate without --check. Affected versions are stated as >= 1.55.0 and <= 1.75.1, with patched version 1.75.2. The advisory states a proposed fix of resolving the hash from block.Bytes, which was tested but is not described as shipped upstream. Workarounds are not stated. Detection guidance beyond the proof-of-concept test is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-w33h-3qgq-8mv8 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116188	rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116188rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit Executive summary The advisory says rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow that lets an unauthenticated network client bypass the configured memory limit for multipart uploads, which can exhaust memory on the host running the service. The severity is rated Moderate, and the advisory lists 1.75.2 as the patched version. Users should upgrade to 1.75.2 or later. Technical summary This is an integer overflow (CWE-190) combined with unbounded resource allocation (CWE-770) in the multipart reorder-memory accounting of rclone serve s3. An attacker who can reach the S3 listener opens two concurrent multipart PUT requests for the current part, each declaring 5,000,000,000,000,000,000 bytes, and withholds the bodies, so the signed int64 accounting field wraps negative and out-of-order parts later pass the capacity check. The advisory says affected versions are 1.75.0 up to but not including 1.75.2, with the patched version listed as 1.75.2. Exploitation needs no credentials when serve s3 runs without --auth-key or --auth-proxy, and authenticated deployments require an accepted S3 credential. The advisory states that no workaround is available beyond binding to a trusted interface, which it says does not fix the arithmetic, and that disabling streaming is not a safe mitigation. Detection guidance is not stated, and the CVSS v3.1 base vector given is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, with an overall score shown as 5.3. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-qjw8-8hmp-c3m6 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.1	CVE-2026-116187	Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116187Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... Executive summary Rclone versions from v1.68.0 before v1.75.2 contain an authorization bypass in its S3 server when run with --auth-proxy, letting one authenticated tenant interfere with another tenant's in-flight multipart uploads. The advisory rates it Moderate with a CVSS score of 6.4, and the recommended fix is to upgrade to v1.75.2. Technical summary The flaw is CWE-639, an authorization bypass through a user-controlled key. The multipart operations UploadPart, CompleteMultipartUpload and AbortMultipartUpload look up uploads by upload ID alone and do not check the caller's tenant, so a tenant who learns another tenant's bucket, object and uploadID can inject data into, complete or abort that upload. The advisory says the attacker must be an authenticated tenant on a server using --auth-proxy with several keys, and must obtain the victim's tuple, which it demonstrates through ListMultipartUploads while owning a same-named bucket. Affected versions are stated as >=v1.68.0 <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround, and detection guidance is not stated. It notes that at-rest content is not read and the destination key is set by the victim at initiate. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-35g6-9fjv-rmx5 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.3	CVE-2026-116186	OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116186OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only... Executive summary The advisory says OpenRemote core (openremote-manager) before 1.31.0 lets a registered edge gateway write and delete assets in any realm, breaking tenant isolation. The advisory gives two different severity ratings: it reports the finding as High, with a base score of 9.6 (Critical) under CVSS v3.1, while the NVD record and the GitHub advisory list it as Low. The fix is to upgrade to version 1.31.0. Technical summary The flaw is an authorization bypass through a user-controlled key: inbound gateway events skip the standard client event authorization, and the only mapping of gateway asset IDs (mapAssetId) shifts the first two characters by a per-gateway offset, which is reversible by anyone who knows the gateway ID. The attacker needs a registered, enabled gateway's service-user credentials, which a realm administrator can obtain, and then can send crafted AttributeEvent or DELETE AssetEvent messages over the gateway session to change attributes or delete leaf assets in other realms. The advisory states the affected versions as less than 1.31.0 and the patched version as 1.31.0, and it says the issue is present in all releases up to 1.26.1. It does not state a workaround. The advisory includes a proof-of-concept that is a standalone re-implementation of the ID transform and does not run against a live system, and it states that a full dynamic test was not performed. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openremote/core/security/adv…/GHSA-8pjc-wq2p-3xr4 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116185	OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116185OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via... Executive summary OpenRemote core versions before 1.31.0 contain an authorization bypass that lets an authenticated user in one realm read active gateway tunnel information belonging to another realm. The advisory rates this Moderate (CVSS 5.0) and states that the fix is to upgrade to version 1.31.0. The attacker must already know or guess a gateway asset ID in the victim realm. Technical summary The flaw is an authorization bypass (CWE-639, CWE-284) in the REST endpoint GET /gateway/tunnel/{realm}/{id}, where getGatewayActiveTunnelInfos does not filter returned tunnels by realm, unlike its sibling methods. Any authenticated non-restricted user can exploit it over the network by passing their own realm in the path and a gateway ID from another realm, leaking target host, target port, and gateway routing data. Affected versions are stated as less than 1.31.0 (package io.openremote:openremote-manager), with the patched version given as 1.31.0. The advisory states no workaround. It also states that exploitation in the wild is not stated, and that the finding was confirmed by static source comparison only, not dynamically executed. Detection guidance beyond the proof-of-concept request pattern is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openremote/core/security/adv…/GHSA-p5wh-9wx4-w5f3 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.1	CVE-2026-116184	OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116184OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the... Executive summary OpenRemote versions before 1.31.0 contain an authorization bypass that lets a user with admin rights in one realm impersonate a gateway that belongs to a different realm. The advisory rates it Low, with a CVSS v4 base score of 2.1, and the patched version is 1.31.0. Technical summary The flaw is an authorization bypass (CWE-639, with CWE-862 also listed) in GatewayService, where gateway websocket events are routed using only the gateway ID and are not checked against the realm of the GatewayConnector. An attacker needs a realm admin account with WRITE:ADMIN in one realm and knowledge of a gateway ID in another realm; they then create a service user named gateway-GATEWAY_ID in their own realm and connect over websocket. The advisory says the attacker could create SSH tunnels during initial sync and overwrite descendant assets of the Gateway asset, though it cannot read existing assets. Affected versions are stated as less than 1.31.0 and the patched version is 1.31.0. No workaround is stated, and no detection guidance is stated. The advisory states no known CVE ID exists, and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openremote/core/security/adv…/GHSA-2j4x-qh6q-q8mm Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116183	phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying... thorsten, phpMyFAQthorsten phpMyFAQ, phpMyFAQ	NVD	Oct 25 14:16 UTC
CVE-2026-116183phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying... Executive summary An unauthenticated visitor can modify or delete any visitor-submitted question in phpMyFAQ versions before 4.1.10 (the advisory lists affected versions as up to and including 4.2.0-beta). The advisory rates it High at CVSS 7.5 under the default configuration, and Critical at 9.1 when the option to delete open questions after answering is enabled. The advisory recommends upgrading to 4.1.10, which is listed as the patched version. Technical summary The flaw is an object-level authorization bypass (CWE-639) in POST /api/faq/create, where the client-supplied openQuestionID is cast to an integer and used directly as the key for UPDATE or DELETE queries on the faqquestions table, with no ownership, visibility, or permission check. Exploitation requires no account or CSRF token, only solving the graphical CAPTCHA, and the advisory states no user interaction is needed. With records.enableDeleteQuestion false (the shipped default), the attacker can rewrite a question's category and answer link (CVSS 7.5, integrity impact only); with it true, the question is permanently deleted (CVSS 9.1). The advisory lists the affected versions as <= 4.2.0-beta and the patched version as 4.1.10. Workarounds are not stated beyond the suggested code fix, and no detection guidance is given. No CVE ID is assigned in the advisory (it says 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/thorsten/phpMyFAQ/security/a…/GHSA-9m55-g84r-x6v7 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects thorsten phpMyFAQ thorsten phpMyFAQ phpMyFAQ NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116182	phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers thorsten, phpMyFAQthorsten phpMyFAQ, phpMyFAQ	NVD	Oct 25 14:16 UTC
CVE-2026-116182phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers Executive summary phpMyFAQ versions before 4.1.10 contain a server-side request forgery flaw in the PDF export feature, which can make the server fetch external images referenced in FAQ answers. The advisory rates it Moderate with a CVSS overall score of 5.0, and the fix is to update to version 4.1.10. Technical summary The flaw is server-side request forgery in the PDF export feature, which fetches image URLs in FAQ answers during PDF generation; in the tested setup a loopback-only HTTP service was requested and its response embedded in the PDF. Exploitation requires that localhost be listed in records.allowedMediaHosts and that an attacker can create or modify FAQ content, and the advisory states the full chain was not proven to be achievable by an entirely unauthenticated attacker. Affected versions are stated as <= 4.1.9 and the patched version as 4.1.10. The advisory does not state a workaround, and the CVSS vector given is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. No CVE identifier is listed (the advisory reports 'No known CVE'), and no detection guidance beyond the proof-of-concept steps is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/thorsten/phpMyFAQ/security/a…/GHSA-8wmv-9c4g-p5mg Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects thorsten phpMyFAQ thorsten phpMyFAQ phpMyFAQ NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.1	CVE-2026-116181	vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116181vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids Executive summary The advisory says vLLM versions from 0.20.1 before 0.29.0 contain a flaw in which a single crafted request with an out-of-vocabulary stop token ID can crash the inference engine and interrupt service for other users. The advisory rates the issue Moderate with a CVSS v3.1 base score of 6.5, and the fix is to upgrade to 0.29.0 or later. Technical summary The weakness is improper input validation (CWE-129, with related CWE-248, CWE-400 and CWE-787) in stop_token_ids, which were checked only to be integers and not against the model vocabulary. A remote attacker who can send OpenAI chat or completion requests, or the legacy generate endpoint, with an out-of-vocabulary ID can trigger an assertion and terminate the engine on the default V1 runner, or write outside the logits buffer on the V2 runner. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, so low privileges are required. Affected versions are stated as greater than or equal to 0.20.1 and less than 0.29.0, and the patched version is stated as 0.29.0, with the fix in PR #54196 that rejects invalid IDs as request errors. The advisory does not state any workaround, and it gives no detection guidance or information about exploitation in the wild. No CVE identifier is listed (it states 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-w9r6-29q4-pvpr Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.3	CVE-2026-116180	vLLM from 0.8.5 before 0.31.0 has a denial of service flaw vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116180vLLM from 0.8.5 before 0.31.0 has a denial of service flaw Executive summary The advisory says vLLM versions from 0.8.5 before 0.31.0 contain a denial of service flaw. A single crafted API request using prompt_logprobs against a connector-cached prefix can crash the engine process, dropping all in-flight requests from other users on that engine. The advisory rates it High (7.7 CVSS as stated), and the patch replaces uninitialized memory with zero and negative infinity defaults; the advisory states the fix has not landed upstream yet. Technical summary The flaw is classed as use of uninitialized resource (CWE-908) leading to uncontrolled resource consumption (CWE-400) in LogprobsTensors.empty_cpu() in vllm/v1/outputs.py, which uses torch.empty(). Exploitation requires the V1 engine with a KVConnectorBase_V1 subclass that reports externally computed tokens, plus a request with prompt_logprobs (or logprobs with echo=true); the advisory lists network attack vector, low complexity, and low privileges. The proposed patch uses torch.zeros() and torch.full(-inf), and the advisory says a Fixes trailer should reference commit 3aee6573dc58. Workarounds stated are disabling KV connectors, stripping prompt_logprobs, logprobs and echo at a gateway, or applying the patch. The advisory lists affected versions as v0.8.5 onward through HEAD, and the patched version is written as >= 0.31.0. Detection guidance is not stated, and whether the fix has been released in a tagged version beyond the advisory's note that main is still affected is not stated beyond that. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: PyPI vllm Summarized from github.com/vllm-project/vllm/security/a…/GHSA-rhcx-5729-88vg Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116179	vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116179vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through... Executive summary A flaw in vLLM, an open-source system for serving large language models, lets API clients bypass a frame-count limit on inline video uploads. The advisory says it can cause excessive memory and CPU use and can crash or OOM-kill the serving process, and it is rated High. The fix rejects per-request media decoder overrides by default, and the advisory says deployments should update to version 0.31.0 or later. Technical summary The weakness is CWE-770, allocation of resources without limits or throttling, in VideoMediaIO.load_base64 for video/jpeg input. A client that can call the chat endpoint can set media_io_kwargs.video num_frames to -1 or a very large value, which bypasses the frame cap and makes the API frontend decode and stack every frame in memory. Affected versions are stated as 0.18.0 up to but not including 0.31.0, and the patched version is stated as 0.31.0 or later; the advisory notes the issue was confirmed on 0.19.1. The fix is PR #58830, which rejects non-empty per-request media_io_kwargs by default, and deployments that trust their clients can opt in with --trust-request-mm-kwargs. The advisory does not state a CVSS score, a CVE assignment beyond 'No known CVE', any workaround beyond the flag described, exploitation in the wild, or specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-4m6g-h9mv-wqjc Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116178	vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116178vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the... Executive summary A denial of service flaw in vLLM, an open-source engine for running large language models, lets a remote attacker crash the engine by sending crafted multimodal request data. The advisory rates it Moderate with a CVSS v3.1 base score of 5.9, and says the fix is to upgrade to vLLM version 0.30.0 or later. Technical summary The flaw is improper input validation (CWE-20) in the disaggregated multimodal /inference/v1/generate endpoint, which accepted client-supplied kwargs_data, mm_hashes, and mm_placeholders without checking that they describe a consistent prompt layout. Overlapping or repeated placeholder ranges can reach model code and crash the engine, as reproduced with Qwen2.5-VL-3B-Instruct. Affected versions are stated as greater than or equal to 0.20.0 and less than 0.30.0, and the patched version is stated as greater than or equal to 0.30.0, with the fix in PR #51898. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, requiring no privileges or user interaction. No workaround is stated, no CVE ID is assigned, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-34qw-q2h2-jp3m Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116177	vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL... vllm-project, Vllm, Pillowvllm-project vllm, vLLM, Pillow	NVD	Oct 25 14:16 UTC
CVE-2026-116177vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL... Executive summary vLLM, an open-source system for serving large language models, has a flaw in its Nemotron-VL image processors that lets an unauthenticated remote user exhaust server memory and deny service to other users on the same instance. The advisory rates the issue High, and the fix is to upgrade to vLLM 0.25.0 or later. Technical summary The weakness is CWE-400, uncontrolled resource consumption. Two Nemotron-VL processor modules set Pillow's Image.MAX_IMAGE_PIXELS to None at import time, which disables Pillow's decompression-bomb guard for the whole process. An unauthenticated caller who can reach /v1/chat/completions on an instance that has imported either processor can submit a crafted image that decompresses to a very large size, potentially causing the worker to be killed by the out-of-memory handler. Affected versions are listed as 0.10.2 before 0.25.0 in the NVD description and as <= 0.8.5 in the GitHub advisory, which the advisory does not reconcile; the patched version is stated as 0.25.0 or later. The fix in PR #47010 removes the module-level assignments and adds a decoded pixel-count limit configurable through VLLM_MAX_IMAGE_PIXELS. No workaround beyond upgrading is stated, and no detection guidance is stated. No CVSS score is stated, and the advisory gives severity as High. No known CVE ID is listed in the GitHub text, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-mm38-5g96-7j6x Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm Pillow vllm-project vllm vLLM Pillow NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.8	CVE-2026-116176	vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... vllm-project, Vllmvllm-project vllm, vLLM, Vllm P2pNcclConnector	NVD	Oct 25 14:16 UTC
CVE-2026-116176vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... Executive summary The advisory says vLLM versions from 0.9.2 before 0.24.0 contain a server-side request forgery flaw that lets an API caller make the server open outbound connections and leak key-value cache data from requests processed by a prefill worker using the P2pNcclConnector. It is rated High severity. The recommended fix is to upgrade to vLLM 0.24.0, which removes the affected connector. Technical summary The flaw is classified as CWE-918 server-side request forgery. The OpenAIServing._base_request_id function copies the X-Request-Id HTTP header into the request_id without validation, and P2pNcclConnector.parse_request_id extracts an arbitrary host and port from it using a permissive regex, letting the caller force outbound ZMQ connections and NCCL communicator setup to an attacker-chosen host. The advisory states the affected range as >= 0.9.2, < 0.24.0 when using P2pNcclConnector, with the patched version 0.24.0. The precondition is a prefill worker configured with a kv_producer role and the P2pNcclConnector, and a valid API key or no key if --api-key is unset. PR #44854 removed the affected connector, and the advisory also describes a proposed fix of stripping the header and adding a CIDR or hostname allow-list. The advisory does not state any detection guidance or exploitation in the wild, and no CVSS score is stated beyond the High severity rating. No CVE identifier is given (it says 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-vfp2-c8pq-v6h6 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM Vllm P2pNcclConnector NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.1	CVE-2026-116175	vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116175vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration... Executive summary The vLLM inference server, versions from 0.19.0 before 0.24.0, is affected by a decompression bomb flaw in its chat audio input handling. A remote user who can send chat completion requests can submit a small compressed audio file that expands into a very large decoded output, which can exhaust memory or degrade availability. The advisory rates it Moderate with a CVSS 3.1 base score of 6.5, and the recommended remedy is upgrading to vLLM 0.24.0. Technical summary The weakness is CWE-409, improper handling of highly compressed data, in the multimodal AudioMediaIO path used by /v1/chat/completions for input_audio data URLs and audio_url media. The decoder duration guard added for speech-to-text is not passed through this path, so load_audio is called without a max_duration_s bound. The attack vector is network, with low attack complexity and low privileges required (PR:L), and the advisory notes that PR:N may apply if chat completions lack API-key authentication. Affected versions are stated as >= 0.19.0, < 0.24.0, and the patched version is 0.24.0. The advisory does not state a workaround beyond noting that --allowed-media-domains, fetch timeouts, and HTTP body limits do not enforce a decoded duration budget. Detection guidance is not stated, and no CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-r45p-7qwx-qwjw Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116174	vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116174vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs... Executive summary The advisory says vLLM versions from 0.22.0 before 0.24.0 contain an input validation flaw in the Rust gRPC Generate and GenerateStream service that lets a single request with an invalid prompt token ID crash the inference engine and leave the server unhealthy. The advisory rates it Moderate, and the vendor's recommended fix is to upgrade to vLLM 0.24.0, which is listed as the patched version. Technical summary This is improper input validation (CWE-20) with an uncontrolled resource consumption angle (CWE-400). The gRPC Generate and GenerateStream handlers forward pre-tokenized prompt token IDs to the engine without checking them against tokenizer or model vocabulary bounds, so an out-of-vocabulary value such as 9000000 can trigger a fatal EngineCore failure and make the server unhealthy. The attack vector is network access to the Rust gRPC endpoint with no privileges or user interaction stated as required in the vector used by the publisher; the advisory notes the vector would be PR:L if clients must be authorized. Affected versions are >= 0.22.0, < 0.24.0, with patched version 0.24.0. The advisory's suggested CVSS 3.1 scores are 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and 6.5 with PR:L, while the NVD overall score shown is 5.9 with AC:H. Workarounds are not stated. Exploitation in the wild is not stated. Detection guidance is not stated beyond the suggested fix of returning INVALID_ARGUMENT for out-of-range token IDs. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-w2v2-5662-8v5q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116173	vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116173vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust... Executive summary Versions of vLLM from 0.22.0 before 0.24.0 contain a denial-of-service flaw that lets a remote attacker crash the engine core with a single crafted request. The advisory rates it Moderate, with a CVSS 5.9 score, and the fix is to upgrade to vLLM 0.24.0. Technical summary The flaw is missing input validation (CWE-20) in the Rust gRPC Generate and GenerateStream path, which accepts output_candidates.token_ids and passes them into SamplingParams.logprob_token_ids without the length cap of 128, vocabulary range checks, or logprobs consistency checks that the Python API enforces. A request with output_logprobs set to true and more than 128 candidate token IDs is accepted, reaches the V1 GPU logprob sampler, and raises a ValueError there, which EngineCore treats as a fatal error. The advisory lists the attack vector as network, attack complexity as high, no privileges or user interaction required, and availability as the only impact, with a base score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected versions are stated as 0.22.0 up to but not including 0.24.0, and the patched version is 0.24.0. The advisory does not state any workaround, any detection guidance, or whether the flaw has been exploited in the wild. Its suggested fix is to reject oversized or out-of-vocabulary candidate ID lists with INVALID_ARGUMENT before any engine request is submitted. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-6pgw-f3pv-4h8q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116172	vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116172vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via... Executive summary A flaw in the Rust gRPC interface of vLLM versions from 0.22.0 before 0.24.0 lets a remote caller bypass the configured limit on logprob counts, which can crash the inference engine. The advisory rates it Moderate with a CVSS 3.1 base score of 5.9, and the fix is to upgrade to vLLM 0.24.0. Technical summary The vulnerability is improper input validation (CWE-20) with an unsigned-to-signed integer cast (CWE-190) in the Rust gRPC converter, which copies the CandidateTokens.top_n value into SamplingParams.logprobs or prompt_logprobs without checking the max_logprobs cap. Values such as 1000000 or 2147483648 (which wraps to a negative number) reach the V1 sampler's torch.topk path and can raise an error that the advisory says makes EngineCore fail. The attack requires network access to the Rust gRPC endpoint with no privileges or user interaction, and the advisory's impact is availability only (CVSS AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H in the NVD metrics). The fixed version is stated as 0.24.0, and the advisory says the patch is to validate top_n against max_logprobs and i32 range. No workaround is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-rwfw-xvg3-3937 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116171	SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and... siyuan-notesiyuan-note siyuan	NVD	Oct 25 14:16 UTC
CVE-2026-116171SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and... Executive summary SiYuan note-taking software on Windows, versions from 3.5.4 through 3.8.6 according to the advisory, can be tricked into copying its private configuration, including the API token and TLS private keys, into publicly reachable files. The advisory rates it High with a CVSS 3.1 base score of 7.5. The fix is to upgrade to v3.8.7. Technical summary The flaw is a path traversal (CWE-22) caused by an incomplete denylist (CWE-184) in util.IsSensitivePath, which does not normalize the Windows extended-length prefix \\?\. Prefixing a protected path with that prefix bypasses the check, and the POST /api/import/importStdMd endpoint then copies the workspace conf directory into data/assets/, which is served without authentication. The advisory's CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and it states that the affected versions are 3.5.4 to 3.8.6 with v3.8.7 as the patched version. The advisory does not state a workaround. It does not state whether the flaw has been exploited in the wild, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-6gmc-424x-xgpm Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note siyuan-note siyuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116170	SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116170SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values Executive summary SiYuan versions before v3.8.7 contain a SQL injection flaw in the history search feature that can expose the contents of the history database. Only holders of an administrator API token can exploit it, and the advisory rates it Moderate with a CVSS score of 4.9. The recommended fix is to upgrade to v3.8.7. Technical summary The flaw is SQL injection (CWE-89) in the history search, where the op field and the query field used when type=3 are concatenated into SQL without escaping, and the resulting statement runs against history.db without a single-statement or read-only check. The advisory states the attack vector is network, complexity low, privileges high (admin token required), no user interaction, with high confidentiality impact and no integrity or availability impact. Affected versions are stated as <= 3.8.6 and the patched version as v3.8.7. The advisory lists remediation as escaping op and query and adding single-statement and read-only checks to the history query functions. No workaround is stated, and no CVE identifier is stated (the advisory says 'No known CVE'). Exploitation in the wild is not stated. Detection guidance beyond the proof of concept is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-4hjx-84f6-gr7c Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.1	CVE-2026-116169	SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math... siyuan-note, SiYuan, KaTeXsiyuan-note siyuan, KaTeX, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116169SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math... Executive summary SiYuan, a note-taking application, from version 2.10.0 before 3.8.7 contains a stored cross-site scripting flaw. A user with edit permission can plant a math block that runs attacker script in the application when another user clicks a link in it. The advisory rates the severity as High and the fix is to update to version 3.8.7 or later. Technical summary The flaw is stored cross-site scripting (CWE-79) in math block rendering. KaTeX is run with trust set to true and its output is assigned via innerHTML without sanitization, so a \href, \url, or \includegraphics with a javascript: URL is preserved and executes when a reader clicks the rendered link. Preconditions are edit permission on a document and a victim clicking the link; the advisory notes no click means no execution. Affected versions are stated as 2.10.0 and later (before 3.8.7 per the advisory's range), and the patched version is listed as v3.8.7. No workaround is stated. Detection guidance is not stated, and no CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-hhvq-jqv9-pgjq Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan KaTeX siyuan-note siyuan KaTeX SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116168	SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits... siyuan-note, SiYuan, b3logsiyuan-note siyuan, SiYuan, b3log siyuan-note	NVD	Oct 25 14:16 UTC
CVE-2026-116168SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits... Executive summary SiYuan, a self-hosted note-taking application, has a path traversal flaw in its MCP asset upload tool that lets an agent-facing caller copy sensitive files from the host, such as a home-directory .env file, into the workspace where they can be read back. The advisory rates it High. The advisory says the fix to be applied is version 3.8.7 and that the vendor's patch is incomplete, since the earlier sensitive-path blacklist omits some secret-bearing filenames. Technical summary The weakness is CWE-22 path traversal with information exposure (CWE-200): the MCP asset upload tool passes file paths through a sensitive-path blacklist (util.IsSensitivePath) that does not cover names such as .env, so a local file is copied into the workspace data/assets directory and served back over HTTP to authenticated sessions. The advisory states affected versions are 3.8.6 and earlier (<= 3.8.6) and the patched version is v3.8.7, but it describes the v3.8.7 fix as incomplete, and it does not state whether 3.8.7 itself fully resolves the issue. Preconditions include an API token for an agent or admin principal driving the MCP server and a file readable by the server process. The advisory's proof of concept was run against v3.8.6 in a Docker lab, and it reports the upload succeeded under the fixed build. No workarounds are stated. No detection guidance is stated. No CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-q768-4j87-gf3w Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan b3log siyuan-note siyuan SiYuan b3log siyuan-note NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116167	SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href... siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116167SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href... Executive summary SiYuan versions from 2.9.0 through 3.8.6 contain a cross-site scripting flaw on the unauthenticated /check-auth page. A victim who opens a crafted link and logs in on that page can have attacker script run inside the authenticated kernel session. The advisory rates it Moderate with a CVSS score of 6.8, and the fix is version 3.8.7. Technical summary The flaw is DOM-based cross-site scripting caused by the to query parameter on /check-auth being assigned to window.location.href without scheme validation, so a javascript: URI runs after a successful login. The attack requires a network-reachable kernel, a victim who opens a crafted link, and a valid access auth code entered by that victim (CVSS AV:N/AC:H/PR:N/UI:R). The advisory states affected versions as >= 2.9.0, <= 3.8.6 and the patched version as v3.8.7. No workaround is stated. Detection guidance is not stated, though the advisory gives a proof-of-concept URL pattern containing a javascript: value in the to parameter. The advisory also states that exploitation in the wild is not mentioned, and it lists no CVE ID. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-fmj3-xc2f-6w4w Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116166	SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116166SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS Executive summary SiYuan versions from 3.6.0 up to and including 3.8.6 have a flaw where an administrator setting meant to turn on encrypted HTTPS serving is accepted but not enforced, so the kernel also answers unencrypted HTTP on the same port. A network-adjacent attacker could read login details and session cookies, and the advisory rates the issue Moderate with a CVSS score of 6.8. The fix is to upgrade to version 3.8.7, which the advisory lists as the patched version. Technical summary The weakness is cleartext transmission of sensitive information (CWE-319). The networkServeTLS setting, changed through POST /api/system/setNetworkServeTLS, is persisted but not used to restrict the listener, so the kernel port serves plain HTTP with full API access alongside HTTPS. The session cookie also lacks the Secure attribute and HTTPS responses lack Strict-Transport-Security, which the advisory says compounds the exposure. Affected versions are stated as >= 3.6.0, <= 3.8.6, and the patched version is v3.8.7. The attack vector is Adjacent with high complexity and no privileges or user interaction required, and the CVSS vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The advisory does not state any workaround other than upgrading, and it does not state whether the flaw is exploited in the wild. The advisory lists No known CVE for this record. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-hpj5-f7cj-vvwr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.8	CVE-2026-116165	Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116165Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key... Executive summary A flaw in Parse Server, a backend framework, lets clients without the master key delete class schemas on MongoDB deployments. The advisory rates it High (CVSS v4 8.8) and says deleted schemas also remove class-level permissions and protected fields, which can expose or modify data. Technical summary This is a missing authorization flaw (CWE-862) in Parse Server on MongoDB deployments. A remote, unauthenticated client without the master key can delete the stored schema of any class through the REST API, removing field definitions, class-level permissions and protected fields; object ACLs still apply. The advisory lists affected versions as >= 9.0.0, < 9.10.4-alpha.4 and < 8.6.101, with patched versions 9.10.4-alpha.4 and 8.6.101. PostgreSQL deployments are stated to be unaffected. The vendor's workaround is to register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key. The advisory states that upgrading does not restore already deleted schemas, so administrators should review and restore permissions, protected fields and field definitions. No CVE ID is assigned in the advisory, and no detection guidance or known exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-qmg9-m772-5rm7 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116164	Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116164Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal... Executive summary Parse Server, a Node.js backend framework, has a flaw that lets clients write objects with reserved internal field names. On MongoDB deployments this can make reads of affected objects fail for all users of that class, and any user can clear internal account lockout or password history fields on their own account. The advisory rates the issue Moderate and recommends upgrading to Parse Server 8.6.100 or 9.10.4-alpha.3, or applying a beforeSave Cloud Code trigger workaround. Technical summary The weakness is CWE-20, Improper Input Validation, where Parse Server does not reject reserved internal field names in client object writes. The attack is network based with low complexity and requires no privileges or user interaction, but the attacker must be allowed to create objects in a class, and the advisory notes the MongoDB-specific read failure. Affected versions are stated as >= 9.0.0 and < 9.10.4-alpha.3, and < 8.6.100, with patched versions 9.10.4-alpha.3 and 8.6.100. The documented workaround is registering a beforeSave Cloud Code trigger for every writable class, including _User, which discards reserved field names; existing bad fields must be removed directly in MongoDB. The advisory does not state any detection guidance, and it does not state whether the issue is exploited in the wild. CVSS v4 base score is shown as 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. No CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-gwrq-q25v-g8mr Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Critical	9.1	CVE-2026-116163	Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116163Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom... Executive summary A flaw in Parse Server, a server framework for building app backends, lets attackers bypass authentication when an app uses a custom authentication adapter built as a subclass of AuthAdapter. The advisory rates it Critical with a CVSS 9.1 score and says the fix is to upgrade to Parse Server 8.6.102 or 9.10.5-alpha.2, or to rework custom adapters as described in the workarounds. Technical summary The weakness is classified as CWE-287, Improper Authentication. Custom adapters that extend AuthAdapter never had their validateSetUp, validateLogin, and validateUpdate methods called, so the inherited default accepting any authData was used instead. The advisory states the attack is network-based with low complexity and no privileges or user interaction required, and that an attacker can sign up, link an identity, or log in as an existing user without valid credentials. Affected versions are stated as 9.0.0 up to but not including 9.10.5-alpha.2, and versions before 8.6.102; patched versions are 9.10.5-alpha.2 and 8.6.102. Workarounds are to implement all validation in an overridden validateAuthData method that does not rely on adapter instance state, or to define the adapter as a plain object. The advisory does not state any detection guidance or indicators of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-rq3w-5c6f-p7wr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.1	CVE-2026-116162	Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116162Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code Executive summary Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 let a user with SMS multi-factor authentication enabled change restricted fields on their own account. The advisory rates the severity as Low, with a CVSS v4 score of 2.1. Technical summary The flaw is classified as CWE-269, Improper Privilege Management. When requesting an SMS MFA login verification code, Parse Server saved the entire login request with master privileges, so extra account fields in that request were persisted, bypassing write restrictions such as beforeSave triggers. Exploitation requires an account enrolled in SMS MFA and high privileges as listed in the CVSS vector, and it is limited to the requester's own account. Affected versions are stated as greater than or equal to 9.0.0 and less than 9.10.5-alpha.5, and less than 8.6.104; patched versions are 9.10.5-alpha.5 and 8.6.104. The advisory states there is no configuration workaround and recommends upgrading. No detection guidance is stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-9rh6-r4ph-367v Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.0	CVE-2026-116161	Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116161Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery Executive summary Parse Server, a Node.js backend package, has an information disclosure flaw in its LiveQuery feature. Subscriptions that use a $or query can receive another user's events, including session tokens, which could let an attacker act as another user. The advisory rates it Moderate and recommends upgrading to a patched version (9.10.5-alpha.4 or 8.6.103). Technical summary The flaw is CWE-200 (exposure of sensitive information to an unauthorized actor) in Parse Server's LiveQuery. The subscription hash omits query constraints placed next to a $or operator, including the server-added _Session owner filter and constraints added by beforeSubscribe triggers, so different clients can be grouped into one subscription and receive each other's events. The advisory lists network attack vector, low attack complexity, low privileges required, no user interaction, and a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, with an overall score of 6.0. Affected versions are >= 9.0.0 and < 9.10.5-alpha.4, and <= 8.6.102; patched versions are 9.10.5-alpha.4 and 8.6.103. Workarounds are to protect sensitive classes with ACL or class-level permissions, avoid $or in _Session subscriptions, and avoid $or where isolation depends on constraints beside it. The advisory does not state any detection guidance, and it lists no CVE ID. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-349r-988w-x3jp Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116160	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116160ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a heap-based buffer overflow in the X11 animate operation when processing a crafted image. The advisory rates the severity as low, with a CVSS v3.1 base score of 3.3, and recommends upgrading to 7.1.2-33 or 6.9.13-58. Technical summary The flaw is a heap-based buffer overflow (heap buffer over-write) triggered when X11 animate processes a crafted image. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, so exploitation requires local access and user interaction, and the advisory describes only a low availability impact. Affected versions are below 7.1.2-33 and below 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround, and it gives no detection guidance, exploitation-in-the-wild status, or CVE identifier (it says No known CVE). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-6p6q-wfrv-ffhh Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116159	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116159ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up... Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak in the -cdl (color decision list) option. The advisory rates it low severity, with a CVSS v3.1 base score of 3.3, and the fix is to update to 6.9.13-58 or 7.1.2-33. Technical summary The flaw is a missing release of allocated memory (CWE-401) in the handling of the -cdl option, which causes a memory leak. The attack vector is listed as local, with low attack complexity, no privileges required, and user interaction required, and the impact is stated as low availability only (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Affected versions are stated as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. No CVE ID is assigned in the advisory. Workarounds and detection guidance are not stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-c2qq-jqw7-q4mx Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.0	CVE-2026-116158	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116158ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails Executive summary A memory leak in the magick compare command of ImageMagick, a tool for editing and comparing images, affects versions before 7.1.2-33. The advisory rates it Low severity, with a CVSS score of 2.5, and the fix is to update to version 7.1.2-33. Technical summary The flaw is a memory leak (CWE-401, missing release of memory) caused by missing cleanup in magick compare when an operation fails. The advisory describes it as a local attack requiring high attack complexity and user interaction, with no privileges needed, and a CVSS v3.1 vector of AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. The impact is limited to availability (low). Affected versions are stated as before 7.1.2-33 and the patched version is 7.1.2-33. No CVE identifier is listed (the advisory says No known CVE). Workarounds are not stated, and no detection guidance or indication of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-m938-565c-h9qf Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116157	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties ImageMagickImageMagick, ImageMagick PerlMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116157ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties Executive summary A memory leak in the PerlMagick interface of ImageMagick, a widely used image processing library, is rated Low severity by the advisory. The fix is to upgrade ImageMagick to version 7.1.2-33 or later, which the advisory names as the patched version. Technical summary The flaw is CWE-401, missing release of memory after effective lifetime, in five locations in PerlMagick that return values that are never freed when image properties are read. The advisory gives a CVSS v3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L with a base score of 3.3, meaning local access and user interaction are required and the impact is limited to availability. Affected versions are stated as before 7.1.2-33 and the patched version is 7.1.2-33. The advisory does not state any workaround, whether the flaw is exploited in the wild, or any detection guidance. The advisory lists no CVE ID, though the page identifier is CVE-2026-116157. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-pj4h-g4pf-66v3 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick ImageMagick PerlMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116156	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116156ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak that occurs when the -set profile option is used. The advisory rates the issue as low severity, with a CVSS v3.1 base score of 3.3, and the fix is to update to 6.9.13-58 or 7.1.2-33. Technical summary The flaw is a memory leak (CWE-401, missing release of memory after effective lifetime) caused by a missing cleanup step when the -set profile option is used. The attack vector is local, attack complexity is low, no privileges are required, and user interaction is required; the impact is low availability only, with no confidentiality or integrity impact. Affected versions are listed as before 7.1.2-33 and before 6.9.13-58, and patched versions are 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround, and it provides no detection guidance. No CVE ID is assigned in the advisory, and it does not state whether the issue is known to be exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-7r5g-p7ff-jgcp Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116155	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116155ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders Executive summary A memory leak in ImageMagick, an image processing software package, can be triggered by a crafted XMP profile processed by various decoders. The advisory rates the severity as Moderate with a CVSS base score of 5.3. The fix is to update to 7.1.2-33 or 6.9.13-58, depending on the branch in use. Technical summary The flaw is a memory leak (CWE not stated; the advisory lists no CWEs) triggered when ImageMagick parses a crafted XMP profile in various decoders. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so the attack is remote and needs no privileges or user interaction, with only a low availability impact. Affected versions are below 7.1.2-33 and below 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround, whether the issue is exploited in the wild, or any detection guidance. No CVE identifier is listed in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-5jf2-9gcp-q234 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116154	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116154ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting... Executive summary ImageMagick, an image processing library, contains a memory leak in its XML parsing code that is triggered when parsing hits a nesting depth limit. The advisory rates the severity as Moderate with a CVSS base score of 5.3 and says the fix is to upgrade to patched versions 7.1.2-33 or 6.9.13-58. Technical summary The flaw is a memory leak (CWE not stated; the advisory lists no CWEs) in ImageMagick XML parsing, where allocated memory is not released when parsing reaches the depth limit. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so it is remotely reachable without privileges or user interaction and affects availability only. Affected versions are before 6.9.13-58 and before 7.1.2-33; patched versions are 6.9.13-58 and 7.1.2-33. No workaround, detection guidance, or exploitation status is stated, and no CVE ID is listed (the advisory says No known CVE). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-8ghq-p369-g395 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.0	CVE-2026-116153	ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116153ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested Executive summary ImageMagick builds for 32-bit systems before 7.1.2-33 contain a memory corruption flaw that can be triggered when convex-hull information is requested. The advisory rates it as low severity with a CVSS score of 2.5, and the vendor's fix is to update to version 7.1.2-33. No known CVE identifier is assigned in the advisory. Technical summary The flaw is a heap buffer over-write, classified under CWE-190 (Integer Overflow or Wraparound), that occurs when convex-hull information is requested on 32-bit systems. The advisory lists the attack vector as local, attack complexity as high, no privileges required, and user interaction required, with only low availability impact and no confidentiality or integrity impact. Affected versions are stated as less than 7.1.2-33 and the patched version is 7.1.2-33. Workarounds are not stated, and no exploitation in the wild or detection guidance is mentioned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-7438-vh5v-v52h Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116152	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116152ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path Executive summary ImageMagick versions before 7.1.2-33 contain a memory leak in the MAT image decoder that occurs in a specific error path. The advisory rates the issue as moderate, with a CVSS v3.1 base score of 5.3, and the fix is to update to version 7.1.2-33. Technical summary The weakness is CWE-401 (Missing Release of Memory after Effective Lifetime), a small leak triggered in an error path of the MAT decoder. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so the advisory describes network exploitation with no privileges or user interaction and only low availability impact. Affected versions are stated as less than 7.1.2-33, and the patched version is 7.1.2-33. No workaround is stated, no CVE identifier is listed (it says No known CVE), and no exploitation in the wild or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-83w9-w85j-h9jc Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116151	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116151ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image Executive summary A memory leak in the JNG image encoder of ImageMagick affects versions before 6.9.13-58 and 7.x before 7.1.2-33. The advisory rates it low severity, with a CVSS v3.1 base score of 3.7, and recommends updating to the patched versions 6.9.13-58 or 7.1.2-33. Technical summary The flaw is classified as CWE-401, missing release of memory after effective lifetime, in the JNG encoder, triggered when processing a crafted image. The advisory gives the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, so the attack is network-reachable with high complexity, no privileges, and no user interaction, and the impact is limited to availability. Affected versions are stated as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround. It does not provide detection guidance, exploitation status in the wild, or a CVE identifier (it states No known CVE). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-v9q4-cm37-q2jm Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.3	CVE-2026-116150	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116150ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image Executive summary ImageMagick versions before 7.1.2-33 contain a memory leak in the FPX image encoder that a crafted image can trigger, causing memory exhaustion. The advisory rates the issue Low severity with a CVSS 3.1 base score of 3.1. The recommended fix is to update to version 7.1.2-33 or later. Technical summary The flaw is a memory leak classified as CWE-401 (Missing Release of Memory after Effective Lifetime) in the FPX encoder of ImageMagick. The advisory states the attack vector is network, with high attack complexity, no privileges required, and required user interaction, and the impact is limited to low availability impact with no confidentiality or integrity impact. Affected versions are stated as less than 7.1.2-33 and the patched version is 7.1.2-33. No workaround is stated, and no detection guidance or evidence of exploitation in the wild is stated. No CVE identifier is listed in the advisory beyond the one provided by the requester. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-8w9c-hj38-8pf9 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.2	CVE-2026-116149	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116149ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory flaw that can be triggered by a crafted bzip2-compressed image. The advisory rates it High severity and says the fix is to upgrade to 7.1.2-33 or 6.9.13-58. Technical summary The flaw is a stack-based buffer overflow (stack buffer over-write) when ImageMagick reads bzip2 compressed images, mapped to CWE-787 with related CWE-125 and CWE-573. The advisory lists the attack vector as network with low attack complexity, low privileges required, and no user interaction, based on the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H with a base score of 8.1. Affected versions are stated as before 7.1.2-33 and before 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory states no CVE ID is known. Workarounds are not stated, exploitation in the wild is not stated, and detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-pwpf-8799-94cj Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116148	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116148ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options... Executive summary A code injection flaw in the MVG encoder of ImageMagick affects versions before 6.9.13-58 and 7.x before 7.1.2-33. The advisory rates it Low severity and recommends updating to the patched versions 6.9.13-58 or 7.1.2-33. Technical summary The advisory describes an injection vulnerability in the MVG encoder that does not properly neutralize user-specified drawing options, which can lead to code injection. The CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, meaning local access, no privileges, user interaction required, and low confidentiality impact. Affected versions are stated as before 7.1.2-33 and before 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory lists a CWE-79 cross-site scripting weakness, which appears inconsistent with the described flaw, and no CVE ID is assigned. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-qq8x-fq3x-43h4 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116147	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116147ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use Executive summary ImageMagick, an image processing library, has a flaw in its DJVU image decoder that can cause it to crash. The advisory rates the severity as low, with a CVSS score of 3.7, and the vendor recommends upgrading to ImageMagick 7.1.2-33 or 6.9.13-58, which are the patched versions. Technical summary The flaw is a null pointer dereference (CWE-476) in the DJVU decoder, caused by using the result of a memory allocation without checking it first, so a failed allocation leads to a crash. The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning it is remotely reachable over the network with high complexity, no privileges or user interaction needed, and only low availability impact. Affected versions are listed as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround, and it gives no detection guidance. No CVE identifier is listed (the advisory says 'No known CVE'), and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-v5f5-4v9x-p3f2 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116146	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116146ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image Executive summary A memory leak in the MSL decoder of ImageMagick, an image processing package, can be triggered by a crafted MSL image. The advisory rates it Low, with a CVSS v3.1 base score of 3.7, and recommends upgrading to ImageMagick 7.1.2-33 or 6.9.13-58 or later. Technical summary The flaw is classified as CWE-401 (missing release of memory after effective lifetime) and CWE-400 (uncontrolled resource consumption). The vector is network-based with high attack complexity, no privileges, and no user interaction, and the advisory's vector shows only low availability impact with no confidentiality or integrity impact. Affected versions are listed as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround, and it gives no detection guidance, exploitation status, or CVE identifier (it lists 'No known CVE'). The advisory's text does not explain how the crafted MSL image must be delivered beyond being processed by the decoder. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-j657-rmv3-4m94 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	1.8	CVE-2026-116145	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116145ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j Executive summary ImageMagick, an image processing software package, has a security policy bypass caused by an incomplete fix for an earlier policy bypass. The advisory rates the severity as Low, with a CVSS v3 base score of 3.9. The vendor's recommendation is to upgrade to ImageMagick 7.1.2-32 or 6.9.13-58, depending on the branch in use. Technical summary The weakness is classified as CWE-693 (Protection Mechanism Failure) and results from an incomplete fix of GHSA-jjp4-3fwf-393j, which allowed a policy bypass. The CVSS v3.1 vector is AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L, meaning exploitation requires local access, high complexity, and high privileges. Affected versions are stated as before 6.9.13-58 and before 7.1.2-32, with patched versions 6.9.13-58 and 7.1.2-32. No workaround is stated in the advisory. No detection guidance is stated, and no CVE identifier is listed. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-4wfv-467j-fqh9 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required High User interaction None CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116144	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116144ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow Executive summary ImageMagick versions before 6.9.13-58 and before 7.1.2-33 contain a flaw that can crash the image processing software when it reads a specially crafted file. The advisory rates the severity as low, with a CVSS v3.1 base score of 3.3, and the vendor recommends upgrading to 7.1.2-33 or 6.9.13-58. Technical summary The flaw is uncontrolled recursion (CWE-674) in the MVG decoder, which can exhaust the program stack and cause a stack overflow. The advisory describes the attack vector as local, with low attack complexity, no privileges required, and user interaction required, and it says the impact is limited to low availability loss. Affected versions are listed as less than 7.1.2-33 and less than 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround. It does not state whether exploitation has occurred in the wild, and it gives no detection guidance. No CVE assignment is listed in the advisory text, and the advisory is tagged GHSA-x258-xjqf-6j3f. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-x258-xjqf-6j3f Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116143	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116143ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene... Executive summary A policy bypass in ImageMagick's PS, PDF and XPS decoders lets the security policy's list length limit on scene selection be circumvented. The advisory rates it Low severity with a CVSS 3.1 base score of 3.3, and the fix is to update to a patched version. Technical summary The flaw is classified as CWE-770, allocation of resources without limits or throttling, and the advisory describes it as a policy bypass where a specific argument lets an attacker get around scene selection in the PS, PDF and XPS decoders. The CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, so exploitation requires local access and low privileges with no user interaction, and the impact is limited to availability. Affected versions are below 7.1.2-33 and below 6.9.13-58, and patched versions are 7.1.2-33 and 6.9.13-58. The advisory does not state a workaround, and it does not state any detection guidance or whether the flaw is exploited in the wild. No CVE identifier is listed; the advisory says 'No known CVE'. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-fp46-842c-2v83 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116142	ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116142ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box Executive summary A heap buffer over-read in ImageMagick lets an attacker read memory beyond what was allocated when a minimum-bounding-box is printed. The advisory rates it Low, with a CVSS 3.1 base score of 3.3, and says the fix is to upgrade ImageMagick to version 7.1.2-33 or later. Technical summary The flaw is classified as CWE-125, an out-of-bounds read, and is triggered when a crafted image causes a minimum-bounding-box to be printed. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, so exploitation requires local access and user interaction, and impact is limited to low confidentiality loss. Affected versions are stated as before 7.1.2-33, and the patched version is 7.1.2-33. The advisory does not state any workaround. It also does not give detection guidance or say whether the flaw is exploited in the wild. No CVE identifier is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-5222-mhv9-26rg Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116141	ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116141ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur... Executive summary ImageMagick versions before 7.1.2-33 contain a policy bypass in the UHDR image decoder that lets attackers get around configured image width and height limits. The advisory rates it Moderate, with a CVSS v3.1 base score of 5.3, and the fix is to update to version 7.1.2-33. Technical summary The flaw is classified under CWE-400 and CWE-770: the width and height checks in the UHDR decoder run after decoding rather than before UHDR decoder.decode, so resource limits are not enforced in time. The advisory's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning it is network-reachable with no privileges or user interaction and only low availability impact. Affected versions are stated as before 7.1.2-33, and the patched version is 7.1.2-33. No workaround is stated in the advisory. No CVE identifier is assigned in the advisory ('No known CVE'). Exploitation status and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-h3qx-937j-245g Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116140	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116140ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run Executive summary ImageMagick versions before 6.9.13-58 and before 7.1.2-33 can be tricked into running an executable that the site's policy.xml file blocks. The advisory rates this as low severity with a CVSS base score of 3.3, and the fix is to update to 6.9.13-58 or 7.1.2-33. Technical summary The flaw is an incorrect authorization check (CWE-863) in how ImageMagick parses delegate invocations, which allows an executable blocked in policy.xml to still run. The attack vector is local, with low attack complexity, no privileges required, and user interaction required. The CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. Affected versions are stated as before 6.9.13-58 and before 7.1.2-33, and patched versions are 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround, and it gives no detection guidance. No CVE ID is assigned according to the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-528x-2384-jmxp Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.1	CVE-2026-116139	WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML()... WWBNWWBN AVideo	NVD	Oct 25 14:16 UTC
CVE-2026-116139WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML()... Executive summary WWBN AVideo versions 26.0 through 29.3.0 contain a stored cross-site scripting flaw that lets a logged-in user who can post comments inject JavaScript into pages viewed by others. The advisory does not give a severity rating or CVSS score, and it does not state a fixed version or a vendor recommendation beyond the code change shown. Technical summary The flaw is stored cross-site scripting caused by the markDownToHTML() function, which renders user comment text. The attacker needs an authenticated account able to post comments, and the victim's browser executes the injected script when the comment is viewed. The advisory excerpt shows a code diff that replaces the previous Parsedown safe-mode handling with a custom class that allows only a and img tags, with href, target, src, class and style attributes filtered. The advisory does not state a fixed version number, a workaround, indicators of compromise, exploitation in the wild, or a CVSS score, and it does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/WWBN/AVideo/commit/f13587c59…9273021d29b869594559 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects WWBN WWBN AVideo NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	1.9	CVE-2026-116053	A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1 dbclidbcli mycli	NVD	Oct 25 14:16 UTC
CVE-2026-116053A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1 Executive summary A weakness in the mycli database command-line tool, versions up to 2.29.4 and 2.30.1, could allow an attacker to run operating system commands. The advisory says a public exploit is available, and the vendor did not respond when contacted about the issue. Technical summary The flaw is an OS command injection weakness in the function source_special_command_is_safe in mycli/packages/special/source.py, within a component described as Whitelist. Exploitation requires a local attacker who can manipulate input to that function, and the advisory says the attack can be launched on the local host. A public exploit exists. The advisory does not state a fixed version, a workaround, a CVSS score, or any detection guidance. Defenders should check whether mycli is installed and which version is in use. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dbcli dbcli mycli NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.1	CVE-2026-111497	Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder Microsoft, GoogleMicrosoft .NET, Google Brotli	Microsoft MSRC	Oct 25 14:00 UTC
CVE-2026-111497Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder Executive summary A buffer overflow in the Brotli decoder can let an unauthorized attacker elevate privileges over a network. The advisory does not state a severity rating or a CVSS score, and it does not name a fixed version or a vendor recommendation. Technical summary The flaw is described as a buffer overflow caused by an out-of-bounds write in .NET, the Brotli decoder component. The advisory states that an unauthorized attacker can exploit it over a network to elevate privileges. Affected and fixed version numbers are not stated. Required user interaction, authentication details, and exploitation status are not stated. No workaround or detection guidance is provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Google Microsoft .NET Google Brotli Microsoft Security Response CenterPublished Oct 25, 2026 14:00 UTC Read the advisory
	High	7.8	CVE-2026-114148	ASP.NET Core Elevation of Privilege Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 25 14:00 UTC
CVE-2026-114148ASP.NET Core Elevation of Privilege Vulnerability Executive summary An elevation of privilege flaw affects ASP.NET Core, a Microsoft web framework. The advisory says an authorized local attacker can use it to gain higher privileges. The advisory text provided does not state a severity rating or a vendor fix recommendation. Technical summary The flaw is classed as incorrect default permissions in ASP.NET Core, which allows a local attacker who already holds some authorization to elevate privileges. The attack vector is described as local, with an authorized attacker as the precondition. Affected versions are not stated, and no fixed version is given. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 25, 2026 14:00 UTC Read the advisory
	Medium	5.3	CVE-2026-116052	A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8 LinkStackOrgLinkStackOrg LinkStack	NVD	Oct 25 13:16 UTC
CVE-2026-116052A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8 Executive summary A security flaw has been found in LinkStack, a web-based link management product from LinkStackOrg, affecting versions up to 4.8.8. The advisory describes it as a cross-site request forgery issue that can be exploited remotely. The advisory does not state a severity rating, and the vendor did not respond to early disclosure, so no vendor fix or recommendation is stated. Technical summary The flaw is classified as cross-site request forgery in an unspecified function of LinkStack. The advisory says remote exploitation is possible, but it does not describe the required user interaction or other preconditions. The affected versions are stated as up to 4.8.8. No fixed version is stated, no workaround is stated, no CVSS score is stated, and no detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects LinkStackOrg LinkStackOrg LinkStack NIST National Vulnerability DatabasePublished Oct 25, 2026 13:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116137	adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like... cthackers, adm-zipcthackers adm-zip, adm-zip	NVD	Oct 25 12:16 UTC
CVE-2026-116137adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like... Executive summary The advisory says adm-zip through version 0.6.1, a JavaScript library for handling zip files in Node.js, contains a flaw that lets attackers get past its duplicate-entry check. The advisory text provided is cut off and does not state a severity rating or a fix for this issue. The vendor's recommended action is not stated in the text provided. Technical summary The flaw is a validation bypass: attackers can evade the duplicate-entry check in readEntries() by using canonically equivalent entry names. The advisory excerpt is truncated and does not give the attack vector details, required preconditions, or the full example. Affected versions are stated as through 0.6.1. A fixed version is not stated. A workaround is not stated. Detection guidance is not stated. A CVSS score is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/cthackers/adm-zip Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects cthackers adm-zip cthackers adm-zip adm-zip NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.0	CVE-2026-116136	ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by... ProjectSendProjectSend	NVD	Oct 25 12:16 UTC
CVE-2026-116136ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by... Executive summary ProjectSend versions 2.0.0 through 2.7.1 contain a flaw that lets staff users share files without the authorization they should need. The advisory text provided is cut off and the rest of the description, along with any severity rating, is not stated. Technical summary The advisory describes an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization. The provided text is truncated after the words 'by...', so the exploitation method is not stated. The attack vector and preconditions beyond a staff user account are not stated. The advisory does not state a fixed version, a workaround, a CVSS score, or exploitation in the wild. No detection guidance is stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/projectsend/projectsend Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ProjectSend ProjectSend NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116073	Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via... leon-ai, Leonleon-ai leon, Leon	NVD	Oct 25 12:16 UTC
CVE-2026-116073Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via... Executive summary A path traversal flaw in Leon, an open-source personal AI assistant, lets attackers write files outside the models directory. The advisory text provided is truncated and mostly shows the Leon project's GitHub page, so the severity rating and the full details are not stated. The advisory does not state a vendor fix or recommended action beyond the commit reference. Technical summary The vulnerability is a path traversal in the getModelFileNameFromURL() function, which the advisory says allows attackers to write files outside the models directory. The advisory says Leon is affected before commit 50df142. The attack vector, required privileges, and user interaction are not stated. No fixed release version, workaround, CVSS score, or detection guidance is stated, and the advisory text is cut off before the rest of the description. The remainder of the text is repository page content, not vulnerability detail. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/leon-ai/leon Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects leon-ai Leon leon-ai leon Leon NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116072	Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the... Docile-Alligator, Infinity for RedditDocile-Alligator Infinity for Reddit, Infinity for Reddit	NVD	Oct 25 12:16 UTC
CVE-2026-116072Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the... Executive summary Infinity for Reddit, an Android Reddit client, is affected by a login cross-site request forgery flaw that can log a victim into an attacker-controlled account. The advisory text provided is truncated and does not state a severity rating or the vendor's recommended fix. Defenders should check the NVD entry and the project's release notes for those details. Technical summary The flaw is a login cross-site request forgery (CSRF) vulnerability in Infinity for Reddit through 8.3.4, which lets an attacker log victims into an account the attacker controls. The advisory text is cut off before it explains the root cause, the exact attack preconditions, or user interaction requirements. No fixed version is stated in the provided text, though the affected range ends at 8.3.4. No workaround, CVSS score, exploitation status, or detection guidance is stated. The rest of the text is repository boilerplate from the project's GitHub page and contains no further vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Docile-Alligator/Infinity-For-Reddit Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Docile-Alligator Infinity for Reddit Docile-Alligator Infinity for Reddit Infinity for Reddit NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	8.2	CVE-2026-116071	rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the... rotkirotki	NVD	Oct 25 12:16 UTC
CVE-2026-116071rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the... Executive summary The advisory describes a weakness in rotki, an open-source self-hosted portfolio manager, that affects versions before 1.44.2. An attacker could potentially brute-force encrypted backups because of how the premium sync key is derived. The advisory text provided is truncated and does not state a severity rating, and the vendor's recommendation is only partly visible, pointing to an update beyond the affected range. Technical summary The flaw is classified as weak key derivation: the premium sync key is described as a single unsalted SHA-256 hash, which makes offline brute-force of backups feasible. The advisory states that versions before 1.44.2 are affected, implying 1.44.2 is the fixed version. The attack vector, required privileges, and user interaction are not stated in the provided text. Workarounds are not stated. Detection guidance and exploitation status in the wild are not stated. The CVSS score is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rotki/rotki Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rotki rotki NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116070	Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite... dqzboy, Docker-Proxydqzboy Docker-Proxy, Docker-Proxy	NVD	Oct 25 12:16 UTC
CVE-2026-116070Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite... Executive summary The advisory says Docker-Proxy through 5.1.9 has a missing authentication flaw in the hubcmdui routes/config.js component that lets unauthenticated attackers read and overwrite configuration. The text provided is truncated and the advisory does not state a severity rating or a vendor fix. Defenders should check whether they run Docker-Proxy and restrict access to its admin interface until a fix or guidance is confirmed. Technical summary The flaw is classified as missing authentication (CWE-style access control weakness) in hubcmdui routes/config.js, allowing unauthenticated attackers to read and overwrite configuration. The attack vector and preconditions are not stated in the provided text, and the advisory text is cut off mid-sentence. Affected versions are given as through 5.1.9, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated. The remainder of the text is repository README content that describes deployment and default credentials, not the vulnerability. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/dqzboy/Docker-Proxy Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dqzboy Docker-Proxy dqzboy Docker-Proxy Docker-Proxy NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116069	NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by... Albert-Weasker, NiubiGEOAlbert-Weasker niubigeo, NiubiGEO	NVD	Oct 25 12:16 UTC
CVE-2026-116069NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by... Executive summary The advisory says NiubiGEO versions before 0.3.2 contain an unauthenticated server-side request forgery flaw, which lets remote attackers make the server fetch internal addresses. The advisory text is cut off, so its stated severity score and full impact are not stated. The advisory does not describe a vendor-recommended fix beyond implying that upgrading to version 0.3.2 or later addresses the issue. Technical summary The flaw is a server-side request forgery (SSRF) in NiubiGEO before 0.3.2, reachable without authentication by remote attackers. The advisory text is truncated, so the full attack preconditions, request parameters, and exploit details are not stated. The fixed version is stated as 0.3.2 (the advisory says 'before 0.3.2'). No CVSS score, workaround, mitigation, or detection guidance is stated, and whether the flaw is exploited in the wild is not stated. The remainder of the text is project README content and does not describe the vulnerability further. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Albert-Weasker/niubigeo Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Albert-Weasker NiubiGEO Albert-Weasker niubigeo NiubiGEO NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116068	Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying... DokployDokploy	NVD	Oct 25 12:16 UTC
CVE-2026-116068Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying... Executive summary Dokploy, a self-hosted platform for deploying applications and databases, has an authorization bypass flaw according to the advisory. The flaw lets owners or admins of one organization control other tenants' applications, and the advisory's text is cut off before it states a severity or the vendor's recommendation. Technical summary The advisory describes an authorization bypass in Dokploy through 0.30.10 that allows owners or admins of any organization to control other tenants' applications by supplying a value that is cut off in the text. The attack requires an authenticated account with owner or admin rights in some organization. The advisory text is incomplete and mostly consists of repository page content, so the exact request parameter, the fixed version, any workaround, any CVSS score, and any detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Dokploy/dokploy Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Dokploy Dokploy NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	8.8	CVE-2026-116067	Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read... ananthakumaran, Paisaananthakumaran paisa, Paisa	NVD	Oct 25 12:16 UTC
CVE-2026-116067Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read... Executive summary Paisa, a personal finance manager, has a path traversal flaw in versions before 0.7.8 that the advisory says lets unauthenticated attackers read files. The advisory text is truncated and does not state a severity rating. The advisory does not state a vendor recommendation, so the fixed version 0.7.8 is the only remediation target it mentions. Technical summary The flaw is a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, which lets unauthenticated attackers read files. The advisory text is cut off, so the full impact, attack details, and any further consequences are not stated. Versions before 0.7.8 are affected, and 0.7.8 is the fixed version as stated. No workaround, CVSS score, exploitation status, or detection guidance is stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ananthakumaran/paisa Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ananthakumaran Paisa ananthakumaran paisa Paisa NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	7.0	CVE-2026-116066	Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via... FirecrawlFirecrawl	NVD	Oct 25 12:16 UTC
CVE-2026-116066Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via... Executive summary The advisory says the Firecrawl web scraping and AI data service, before version 2.11.586, has a server-side request forgery flaw in its Playwright service proxy. The advisory text is cut off, so the full severity rating and vendor guidance are not stated here, and defenders should check the original NVD entry for the complete details. Technical summary The flaw is classified as server-side request forgery in the Playwright service SSRF proxy, which lets attackers bypass isInternalHost checks. The advisory text is truncated mid-sentence, so the exact bypass technique and attack preconditions are not stated. The affected versions are stated as all versions before 2.11.586. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory text provided. The remaining text is repository page content and contains no additional vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/firecrawl/firecrawl Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Firecrawl Firecrawl NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116050	A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe krupalshahkrupalshah EmployeeRecruitmentSystem	NVD	Oct 25 09:16 UTC
CVE-2026-116050A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Executive summary A public registration page in the Employee Recruitment System, an open-source project by krupalshah, contains an SQL injection flaw that can be exploited without logging in. The advisory describes it as critical and says an attacker could read, and possibly change, the underlying database. The advisory does not state a vendor fix or patch, and notes the project is no longer maintained. Technical summary The flaw is SQL injection in source/registerform3.php, where POST parameters (post, resume, pemail, semail, setpassword) are concatenated directly into an INSERT statement via mysql_query without sanitisation or prepared statements. It requires no authentication or cookie, and the advisory demonstrates boolean-based and time-based blind techniques using SLEEP() with sqlmap against MySQL/MariaDB. The affected version is stated as V1.0 (master branch, no version tags), and the advisory references commit 922ff6d208278282e7c8e36d70d9ae356adec9fe as the upper bound. No fixed version is stated, and no vendor workaround is given beyond suggested repairs such as prepared statements, input validation, generic error handling, CSRF and rate limiting, and least-privilege database accounts. No CVSS score or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ubfbuz3/cve/issues/61 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects krupalshah krupalshah EmployeeRecruitmentSystem NIST National Vulnerability DatabasePublished Oct 25, 2026 09:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116049	A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe krupalshahkrupalshah EmployeeRecruitmentSystem	NVD	Oct 25 09:16 UTC
CVE-2026-116049A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Executive summary A SQL injection flaw has been reported in the krupalshah EmployeeRecruitmentSystem, an unauthenticated public registration form. An outside attacker could potentially read the underlying database, including records and passwords. The advisory does not state a severity score, and it does not say a fix is available; the advisory's suggested repair is to switch to prepared statements and validate inputs. Technical summary The advisory describes an SQL injection in source/registerform2.php, where eight POST parameters are concatenated directly into an INSERT statement via mysql_query without sanitisation or parameter binding. The endpoint requires no session or login, and the advisory describes boolean-based and time-based blind injection, with a SLEEP payload causing a measurable delay. The affected version is stated as up to 922ff6d208278282e7c8e36d70d9ae356adec9fe, with V1.0 on the master branch and no version tags; the advisory notes the project is no longer maintained by the original vendor. No fixed version is stated. No workaround is stated beyond the suggested repair of prepared statements, input validation, generic error handling, and reduced database permissions. Detection guidance is limited to the described boolean oracle (HTTP 302 versus 200) and response delays, and no CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ubfbuz3/cve/issues/60 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects krupalshah krupalshah EmployeeRecruitmentSystem NIST National Vulnerability DatabasePublished Oct 25, 2026 09:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116048	A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe krupalshahkrupalshah EmployeeRecruitmentSystem	NVD	Oct 25 08:16 UTC
CVE-2026-116048A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Executive summary The advisory reports a pre-authentication SQL injection flaw in the EmployeeRecruitmentSystem project by krupalshah, affecting version V1.0 and the repository state up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. An unauthenticated attacker could read or modify the underlying database through the public registration form. The advisory does not state a severity score, and it does not state any fixed version or vendor patch. Technical summary The vulnerability is an SQL injection (boolean-based and time-based blind) in source/registerform1.php, where nine POST parameters are concatenated directly into an INSERT statement built with mysql_query, without sanitisation or prepared statements. The endpoint requires no session or login, so the attack vector is remote and unauthenticated. The advisory describes a boolean oracle (HTTP 302 for a clean insert versus HTTP 200 with a Database error message for a broken value) and a SLEEP-based time delay, and it reports sqlmap enumeration of a MySQL/MariaDB database. The affected version is stated as V1.0 on the master branch with no version tags, and no fixed version is stated. The advisory suggests prepared statements, input validation, generic error handling, and reduced database privileges, but it does not state a workaround or vendor fix. The advisory does not state a CVSS score or any detection guidance beyond the described response behaviour, and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ubfbuz3/cve/issues/59 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects krupalshah krupalshah EmployeeRecruitmentSystem NIST National Vulnerability DatabasePublished Oct 25, 2026 08:16 UTC Read the advisory
	Low	2.1	CVE-2026-116047	A vulnerability has been found in Privoce Vocechat up to 0.9.121 PrivocePrivoce VoceChat	NVD	Oct 25 08:16 UTC
CVE-2026-116047A vulnerability has been found in Privoce Vocechat up to 0.9.121 Executive summary A cross-site scripting flaw in the VoceChat chat server, made by Privoce, lets an attacker run scripts in a logged-in user's browser by sending a crafted link. The advisory says a proof of concept captured a valid session token, which could allow account takeover without the victim's password. The advisory's CVSS v3.1 score is 8.7 (High), and the vendor's fix is not stated in the advisory, though it recommends removing unsafe HTML rendering and avoiding storing session tokens in localStorage. Technical summary The advisory describes a DOM-based cross-site scripting (CWE-79) in widget.html, where the welcome URL parameter is read client-side and inserted into the DOM without sanitization or encoding. Exploitation requires only that a logged-in victim open a crafted link, with no server round-trip needed, and the proof of concept stole the VOCECHAT_TOKEN and VOCECHAT_CURR_UID values from localStorage. The advisory gives CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N with a score of 8.7. Affected versions are stated only in the title as up to 0.9.121, and the advisory does not state a fixed version. The advisory does not state whether a workaround exists beyond recommended code changes and a Content-Security-Policy, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/H1ck1y/Vulnerabilities/blob/…n/Vocechat_DomXss.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Privoce Privoce VoceChat NIST National Vulnerability DatabasePublished Oct 25, 2026 08:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116046	A flaw has been found in eventcatalog sdk up to 2.29.0 eventcatalogeventcatalog sdk	NVD	Oct 25 07:16 UTC
CVE-2026-116046A flaw has been found in eventcatalog sdk up to 2.29.0 Executive summary A flaw was found in the EventCatalog SDK, versions up to 2.29.0. The advisory describes a path containment issue that let custom doc reads, writes, and deletes reach files outside the catalog docs directory. The advisory text does not state a severity rating, and it shows a code change that fixes the issue. Technical summary The advisory describes a path traversal weakness in the custom doc functions of the EventCatalog SDK, where custom doc file paths were not confined to the catalog docs directory. The fix adds path validation that rejects null bytes, drive-letter and UNC paths, and paths that resolve outside the docs root, and it resolves symlinks so that links pointing outside the docs directory are not followed. The attack vector and required privileges are not stated, and the advisory does not state a CVSS score or whether exploitation occurred in the wild. The advisory text shows a fixed change set in a patch release but does not explicitly name the fixed version number, and it does not state any workaround. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/event-catalog/eventcatalog/c…92e88d8b4893f4c6d6ca Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects eventcatalog eventcatalog sdk NIST National Vulnerability DatabasePublished Oct 25, 2026 07:16 UTC Read the advisory
	Low	2.1	CVE-2026-116045	A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0 1999AZZAR1999AZZAR designer-mcp	NVD	Oct 25 07:16 UTC
CVE-2026-116045A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0 Executive summary The advisory says a vulnerability was detected in the designer-mcp server by 1999AZZAR, affecting versions up to 2.1.0. The text does not state how severe the flaw is or what the vendor recommends, and it gives no fixed version. Technical summary The advisory text is a copied GitHub repository page and does not describe the vulnerability class, attack vector, or preconditions. The only version information is 'up to 2.1.0', and no fixed version is stated. No CVSS score, workaround, mitigation, exploitation status, or detection guidance is stated. The page mentions a previously closed CWE-22 path traversal fix in get_reference (issue #14), but it does not link that fix to this advisory's vulnerability, so it should not be treated as the affected issue. Defenders should check the upstream project and the NVD entry for details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/1999AZZAR/designer-mcp Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects 1999AZZAR 1999AZZAR designer-mcp NIST National Vulnerability DatabasePublished Oct 25, 2026 07:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-94295	The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before... ChikkiliChikkili Google Pay India for Woocommerce	NVD	Oct 25 06:16 UTC
CVE-2026-94295The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before... Executive summary The Chikkili Google Pay India for WooCommerce WordPress plugin, through version 1.0.6, does not verify that payment notifications truly come from the payment provider. This flaw is rated medium severity with a CVSS score of 5.3 in the advisory, and no fixed version is stated, so the advisory gives no vendor fix to apply yet. Technical summary The flaw is a missing authorization issue, classified as CWE-862 and OWASP A5 Broken Access Control, in which the plugin accepts payment notifications without verifying they originated from the payment provider. The advisory states the affected version as through 1.0.6 and lists the status as No known fix, so no fixed version is stated. The advisory does not describe the required attacker position, exploitation in the wild, or any workaround. Detection guidance and vendor remediation steps are not stated. The CVSS score given is 5.3 (medium), and the publication date is listed as 2026-10-22. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/d6ee17a1-0db1-…10-8c96-96e98fb734ec Score No CVSS score published. Affects Chikkili Chikkili Google Pay India for Woocommerce NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Low	2.1	CVE-2026-116044	A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6 prasathmaniprasathmani TinyFileManager	NVD	Oct 25 06:16 UTC
CVE-2026-116044A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6 Executive summary A security flaw has been reported in TinyFileManager, a file management tool made by prasathmani, in versions up to 2.6. The advisory says the flaw allows unrestricted file upload, can be attacked remotely, and that a public exploit exists; the vendor did not respond to early disclosure, and no vendor fix or recommendation is stated. Technical summary The weakness is classified as unrestricted upload of a file, located in the Remote URL File Upload Module of tinyfilemanager.php, and the advisory states it can be triggered remotely. Affected versions are stated as up to 2.6, and no fixed version is stated. The advisory does not state any preconditions such as authentication requirements, nor any workaround. No detection guidance is stated. The exploit is described as publicly disclosed and usable. No CVSS score or exploitation-in-the-wild status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects prasathmani prasathmani TinyFileManager NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-115251	The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and... DuplicatorDuplicator	NVD	Oct 25 06:16 UTC
CVE-2026-115251The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and... Executive summary The Duplicator WordPress plugin, before version 5.0.0, lets users who should not be allowed to install plugins run its one-click upgrade routine, which can lead to privilege escalation. The advisory rates the issue high severity with a CVSS score of 7.2. The fix is to upgrade Duplicator to version 5.0.0 or later. Technical summary The flaw is classified as privilege escalation (CWE-269, improper privilege management) because the one-click upgrade routine is not restricted to users allowed to install plugins. The advisory lists CVSS 7.2 (high) and maps it to OWASP A2 Broken Authentication and Session Management. The advisory does not state the precise attack vector, the exact privilege level required to exploit it, or whether it is being exploited in the wild. Affected versions are stated as before 5.0.0 and the fixed version is 5.0.0. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/c4512e96-6d96-…4e-90c0-ad784eb1c145 Score No CVSS score published. Affects Duplicator Duplicator NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-115214	The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse... DatawizaDatawiza Proxy Auth Plugin	NVD	Oct 25 06:16 UTC
CVE-2026-115214The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse... Executive summary The Datawiza Proxy Auth Plugin WordPress plugin, versions before 1.1.1, can be abused to gain elevated privileges. The advisory rates the issue critical with a CVSS score of 9.8 and says the fix is to update to version 1.1.1. Technical summary The flaw is a privilege escalation issue (CWE-269, improper privilege management) in the plugin's handling of user-identity and role HTTP request headers. The plugin does not verify that these headers come from a trusted reverse proxy, so a request that supplies forged headers may be trusted as an authenticated user with a chosen role. Affected versions are stated as before 1.1.1, and the fixed version is 1.1.1. The advisory does not state specific workarounds, and it gives no detection guidance. Exploitation in the wild is not stated. The CVSS vector string is not stated beyond the 9.8 critical score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2c6c7d10-2281-…98-a0d6-769da5cce416 Score No CVSS score published. Affects Datawiza Datawiza Proxy Auth Plugin NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-115183	The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the... Qi Addons For ElementorQi Addons For Elementor qi-addons-for-elementor	NVD	Oct 25 06:16 UTC
CVE-2026-115183The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the... Executive summary The Qi Addons For Elementor WordPress plugin is affected by a content injection flaw in versions before 1.11.2. The advisory says the flaw is rated low severity (CVSS 2.4), and the fix is to update the plugin to version 1.11.2. Technical summary The flaw is a content injection issue (CWE-345 listed, OWASP A1: Injection) in the plugin's widget heading text handling. The plugin does not properly sanitise heading text after decoding HTML entities, which the advisory says allows users with an unspecified level of access to inject content. The advisory's truncated text does not clearly state the full required privilege level. The fixed version is 1.11.2, and affected versions are described as those before 1.11.2. The advisory does not state any workaround, and it does not give detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/a9cd8675-25f3-…81-b768-4f20ef9208a8 Score No CVSS score published. Affects Qi Addons For Elementor Qi Addons For Elementor qi-addons-for-elementor NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114743	The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action,... instawpInstaWP Connect	NVD	Oct 25 06:16 UTC
CVE-2026-114743The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action,... Executive summary The InstaWP Connect WordPress plugin, versions before 0.1.4.2, is affected by a missing authorization flaw. The advisory rates it low severity (CVSS 3.1 low) and states that the fix is version 0.1.4.2. Technical summary The flaw is classified as CWE-862 (missing authorization) under OWASP A5 Broken Access Control. The plugin does not perform a capability check on its settings update action, so a caller lacking the required privilege may be able to change settings. The advisory states the affected versions as before 0.1.4.2 and the fixed version as 0.1.4.2. The attack vector and required privilege level are not explicitly stated beyond the classification as no authorisation, and the CVSS vector string is not given, only the score rating of low. No workaround and no detection guidance are stated in the advisory, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/b94671c5-c5b5-…8d-ac9c-af21c7cbc6a4 Score No CVSS score published. Affects instawp InstaWP Connect NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114742	The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114742The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to... Executive summary The WPVR WordPress plugin, which manages virtual tours, has a flaw that lets users with contributor-level access and above change virtual tours they do not own. The advisory rates the issue low severity with a CVSS score of 2.7 and says the fix is version 9.0.3. Technical summary The flaw is an insecure direct object reference (IDOR, CWE-639) caused by missing object-level ownership checks when virtual tours are updated. An attacker needs an authenticated account with contributor-level access or higher, and the advisory does not describe any other preconditions. The plugin is fixed in version 9.0.3, and versions before 9.0.3 are affected. The advisory does not state any workaround or detection guidance, and it does not say whether the issue is exploited in the wild. The CVSS score given is 2.7 (low), and the advisory does not give a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/201b0ca5-366d-…6e-a92f-6962cd200bd7 Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114741	The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114741The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access... Executive summary The WPVR WordPress plugin, before version 9.0.3, lets users with contributor-level access read and change virtual tours they should not be able to reach. The advisory rates the issue low severity with a CVSS score of 3.8, and the fix is to update to version 9.0.3 or later. Technical summary This is an insecure direct object reference (IDOR, CWE-639) caused by missing object-level authorization checks when reading and updating virtual tours in the WPVR plugin. An attacker needs contributor-level access on the WordPress site. The advisory states the affected versions as before 9.0.3 and the fixed version as 9.0.3. The advisory does not state any workaround or detection guidance, and it does not state whether the flaw is being exploited in the wild. The CVSS score given is 3.8 (low), and the advisory does not give a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/bfa704b5-b934-…15-aa75-d50b28baedf7 Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114740	The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114740The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and... Executive summary The WPVR WordPress plugin, versions before 9.1.3, contains a flaw that lets low-privileged users change site content they should not be able to change. The advisory rates it medium severity with a CVSS score of 4.9, and the fix is to update to version 9.1.3. Technical summary The flaw is a missing authorization check (CWE-862, broken access control) in the WPVR plugin's setup wizard, which does not correctly verify user capabilities when creating a tour. The advisory says users with the Contributor role and above can exploit it, which is the stated precondition. The fixed version is 9.1.3, and the affected range is versions before 9.1.3. The advisory does not state any workaround or mitigation, and it gives no detection guidance or information on exploitation in the wild. The text is truncated, so further details may be missing. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ac47bef6-b870-…ae-b9ad-ace83687280d Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111981	The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view)... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111981The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view)... Executive summary The GiveWP WordPress plugin, a donation management plugin, contains a flaw that lets users with donor-report view access change donor address information without authorization. The advisory rates the severity as low, with a CVSS score of 2.7, and the fix is version 4.19.0.1. Technical summary The flaw is a missing capability check (CWE-862, broken access control) in GiveWP's handling of donor address changes, so an authenticated user who holds donor-report view permission can modify donor addresses. The advisory describes the affected range as versions before 4.19.0.1 and the fixed version as 4.19.0.1. The CVSS score given is 2.7 (low). Attack vector details beyond the required donor-report view role, workarounds, and detection guidance are not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/9fae25ff-51e6-…37-83d6-e752374dae57 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111980	The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111980The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to... Executive summary The GiveWP WordPress plugin, before version 4.19.0.1, has a flaw that lets users with a custom fundraising role perform actions they should not be allowed to. The advisory rates it as medium severity with a CVSS score of 5.5. The fix is to update to version 4.19.0.1, which the advisory lists as the fixed version. Technical summary The flaw is an incorrect authorization issue (CWE-863) in which the plugin does not correctly determine which page a page-capability request applies to. Users with a custom fundraising role may be able to abuse this to gain access they should not have. The advisory states the fixed version is 4.19.0.1 and the affected versions are before 4.19.0.1. Attack vector and preconditions beyond the custom fundraising role are not stated. Workarounds are not stated. Detection guidance is not stated. The advisory text is truncated, so the full impact description is not available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7664c532-7a74-…de-8ae1-df4862067689 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111979	The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute,... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111979The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute,... Executive summary A cross-site scripting flaw in the GiveWP WordPress donation plugin lets a malicious user inject script through a donation form template setting. The advisory rates it medium severity, with a CVSS score of 6.8, and says the fix is in version 4.19.0.1. Technical summary The flaw is a stored or reflected cross-site scripting (CWE-79) caused by GiveWP not properly sanitising and escaping one donation form template setting before it is output inside an HTML attribute. The advisory lists the affected versions as before 4.19.0.1 and the fixed version as 4.19.0.1. The attack vector, required privileges, and user interaction are not stated in the text provided. No workaround is stated. No detection guidance is stated. The advisory text is truncated and the remaining unrelated entries in the listing describe other plugins. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/59b1b0ff-fbfb-…b8-883e-94b5f2cee5a4 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111978	The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111978The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role... Executive summary The GiveWP WordPress plugin, before version 4.19.0.1, has a flaw that lets users with a high-privilege custom role read files they should not be able to access. The advisory rates it medium severity with a CVSS score of 6.0, and it says the issue is fixed in version 4.19.0.1. Technical summary The flaw is a path traversal weakness (CWE-22, classified as TRAVERSAL) in which the plugin does not properly validate a user-supplied filename before reading it from disk. The attacker must hold a high-privilege custom role, so authentication is required. The advisory states the fix is in version 4.19.0.1 and that the affected versions are before 4.19.0.1. No workaround is stated, and no detection guidance is stated. The advisory also lists several unrelated plugin advisories with dates and titles, which are not clearly tied to this CVE, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ab77a13e-491e-…a9-a50d-839a8ad341aa Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111976	The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111976The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing... Executive summary The GiveWP WordPress plugin is affected by a flaw that can expose sensitive information on public donation form pages. The advisory rates it medium severity with a CVSS score of 5.3, and the fix is to update to version 4.19.0.1. Technical summary The flaw is classified as sensitive data disclosure (CWE-200). The GiveWP plugin does not perform any status or capability check when rendering a donation form on a public front-end route, which allows information exposure to unauthenticated visitors; the advisory text is truncated, so the full impact is not stated. The advisory says the plugin is fixed in version 4.19.0.1 and that earlier versions are affected (before 4.19.0.1). The advisory does not state a workaround, whether exploitation in the wild has been observed, or any detection guidance. The listed related titles refer to other plugins and are not part of this GiveWP flaw. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/f304401f-886c-…06-9629-d8f7a7146b78 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-110285	The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing... WP Stripe CheckoutWP Stripe Checkout wp-stripe-checkout	NVD	Oct 25 06:16 UTC
CVE-2026-110285The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing... Executive summary The WP Stripe Checkout WordPress plugin contains a flaw that lets an attacker bypass authentication for Stripe webhook requests. The advisory rates it medium severity with a CVSS score of 5.3 and says it is fixed in version 1.2.2.62. Technical summary The flaw is classified as an authentication bypass (CWE-287) in which the plugin does not verify the Stripe webhook signature when no signing secret is configured, which the advisory says is the default state. The attack vector is network-based, and the advisory indicates the attacker can gain access without authentication, but the exact impact beyond that is cut off in the text. Affected versions are stated as before 1.2.2.62, and the fixed version is 1.2.2.62. No workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/0f32d471-2806-…71-9a82-87895ef903ae Score No CVSS score published. Affects WP Stripe Checkout WP Stripe Checkout wp-stripe-checkout NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2025-15705	The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web... supsysticsupsystic Contact Form by Supsystic	NVD	Oct 25 06:16 UTC
CVE-2025-15705The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web... Executive summary The Contact Form by Supsystic WordPress plugin is affected by a cross-site scripting flaw that lets users with access to the form editor inject malicious web content. The advisory rates it low severity with a CVSS score of 3.5. The fix is to update the plugin to version 1.8.0 or later. Technical summary The flaw is a stored cross-site scripting (XSS, CWE-79) caused by the plugin not sanitising and escaping a form name. An attacker needs access to the form editor, so the precondition is an authenticated user with that privilege. The advisory states the plugin is affected before version 1.8.0 and fixed in 1.8.0. The advisory does not state a workaround, and it does not give detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7b592632-614d-…92-8372-a38e667e547b Score No CVSS score published. Affects supsystic supsystic Contact Form by Supsystic NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	High	n/a	CVE-2026-109618	CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products Palo Alto Networks, PHPPalo Alto Networks PAN-OS, PHP, Palo Alto Networks Panorama, Palo Alto Networks VM-Series firewalls	Palo Alto Networks	Oct 25 05:25 UTC
CVE-2026-109618CVE-2026-109619CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products Executive summary Palo Alto Networks says two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect its PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The advisory rates the issue HIGH with a CVSS 4.0 base score of 8.7 and says Palo Alto Networks is not aware of any malicious exploitation. The vendor recommends applying the listed threat signatures and restricting management interface access now, and installing fixed PAN-OS releases as they become available, with several listed for late October 2026. Technical summary The flaws are classified as CWE-754 (improper check for unusual or exceptional conditions), and the advisory describes remote code execution through longjmp() handling of out-of-memory and fatal errors in PHP. The advisory states the attack vector is network, attack complexity is low, no privileges or user interaction are required, and the impact is high availability on the product. Affected PAN-OS versions are listed as below 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1, 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 and 10.2.18-h13. The advisory says the issue strictly affects the management web interface (HTTPS web UI and XML API), and affects a dataplane interface only if a management profile is attached. Workarounds include restricting management access to trusted internal addresses or a jump box, enabling listed Threat IDs and content versions, and routing management traffic through a data plane port. The advisory does not state a verified detection method beyond the Threat IDs and points to a Unit 42 article for more detail. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Palo Alto Networks PA-Series firewalls Summarized from security.paloaltonetworks.com/CVE-2026-109618 Score No CVSS score published. Affects Palo Alto Networks PHP Palo Alto Networks PAN-OS PHP Palo Alto Networks Panorama Palo Alto Networks VM-Series firewalls Palo Alto Networks Product SecurityPublished Oct 25, 2026 05:25 UTC Read the advisory
	Low	2.9	CVE-2026-116007	A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 YunaiV, zhijiantianya, YunaiV / zhijiantianyaYunaiV ruoyi-vue-pro, zhijiantianya ruoyi-vue-pro, YunaiV / zhijiantianya ruoyi-vue-pro	NVD	Oct 25 04:17 UTC
CVE-2026-116007A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 Executive summary The advisory reports that the YunaiV ruoyi-vue-pro (Yudao) project, up to version 2026.09, lets an unauthenticated attacker guess SMS verification codes without any attempt limit, which can lead to takeover of an account such as the built-in administrator. The advisory rates it Critical with a CVSS 3.1 score of 9.8, as stated by the reporter. The advisory states no fixed version exists as of 2026-09-21, and its remediation advice is to add failed-attempt counting and lockout to code verification. Technical summary The weakness is improper restriction of excessive authentication attempts (CWE-307, CWE-799, CWE-287) in the SMS verification code check, which keeps no failed-attempt counter, lockout, or rate limit. The attack needs only network access to the backend API and the target's mobile number, with no authentication and no user interaction; the advisory states the built-in admin's mobile number is published in the seed SQL. The advisory reports that POST /admin-api/system/auth/sms-login and POST /admin-api/system/auth/reset-password both accept a correct code, and that the login scene (scene=21) needs no CAPTCHA. Affected branches are listed as master, master-jdk17, and master-jdk25, with verified version master-jdk17 @ 7cab3a7; the fixed version is stated as none as of 2026-09-21. A workaround is not stated beyond the remediation suggestions, and no detection guidance is given beyond the advisory's suggestion to alert on abnormal verification volume per mobile and IP. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Fulucky0-yuri/63e3a697e…ffd41c1cbfdbb1fcd5b4 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV zhijiantianya YunaiV / zhijiantianya YunaiV ruoyi-vue-pro zhijiantianya ruoyi-vue-pro YunaiV / zhijiantianya ruoyi-vue-pro NIST National Vulnerability DatabasePublished Oct 25, 2026 04:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116006	A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 YunaiV, zhijiantianyaYunaiV ruoyi-vue-pro, zhijiantianya ruoyi-vue-pro	NVD	Oct 25 04:17 UTC
CVE-2026-116006A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 Executive summary A vulnerability was reported in the ruoyi-vue-pro project from YunaiV and zhijiantianya, affecting versions up to 2026.09. The advisory says an attacker can log in as any account whose mobile number they know, including the built-in administrator, without a password or verification. The advisory does not state a vendor recommendation or a fix; it says no fixed version was available as of 2026-10-21. Technical summary The weakness is a predictable SMS verification code (CWE-1188, CWE-798, CWE-640) caused by begin-code and end-code both being set to 9999 in the base application.yaml, so every SMS login code is 9999. An unauthenticated attacker calls send-sms-code with scene 21 and then sms-login with code 9999 to receive a full access token, with no CAPTCHA or user interaction required. The advisory gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N with score 9.1. Affected branches are master, master-jdk17 and master-jdk25, and the fixed version is stated as none as of 2026-10-21. No workaround beyond overriding the begin-code and end-code values is explicitly stated as a vendor recommendation, and no exploitation in the wild or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Fulucky0-yuri/1ad8a1f16…7cb85c498473753a8636 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV zhijiantianya YunaiV ruoyi-vue-pro zhijiantianya ruoyi-vue-pro NIST National Vulnerability DatabasePublished Oct 25, 2026 04:17 UTC Read the advisory
	Low	2.0	CVE-2026-116004	A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0 onyx-dot-apponyx-dot-app Onyx	NVD	Oct 25 03:16 UTC
CVE-2026-116004A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0 Executive summary A security vulnerability has been reported in Onyx, an open source AI platform from onyx-dot-app, in versions up to 5.0.0. The advisory text provided is mostly repository page content and does not describe the flaw, its severity, or a vendor fix. Defenders should check the original NVD entry and vendor channels for details and remediation guidance. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It names affected versions as up to 5.0.0 but does not state a fixed version, workaround, CVSS score, exploitation status, or detection guidance. The text provided is largely GitHub repository page content describing Onyx features and deployment modes. Teams running Onyx 5.0.0 or earlier should consult the NVD record and the upstream project for the specific flaw details and patched release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/onyx-dot-app/onyx Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects onyx-dot-app onyx-dot-app Onyx NIST National Vulnerability DatabasePublished Oct 25, 2026 03:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116000	A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1 ZylonZylon PrivateGPT	NVD	Oct 25 03:16 UTC
CVE-2026-116000A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1 Executive summary A path traversal flaw has been reported in Zylon PrivateGPT versions 1.0.0 and 1.0.1. An attacker who can call the asynchronous ingestion API could read local files on the server and then query the language model to retrieve their contents. The advisory does not state a severity rating, and it does not describe a vendor-issued fix or recommended action beyond the issue's closure as not planned. Technical summary The flaw is an arbitrary file read caused by path traversal, where the /v1/artifacts/ingest/async endpoint accepts a UriArtifact value that points to a local file such as file:///etc/passwd. The reporter states that UriArtifact lacks a field validator, so the existing URI validation is bypassed, and that the raw path reaches the Celery worker, where functions in utils.py open and read the file. The reporter describes the attack as requiring only a POST request to the endpoint, with the file contents then retrievable through LLM queries. The advisory does not state the authentication requirements, the CVSS score, or a fixed version. It reports the affected version as the latest main branch in the reporter's environment, not a specific release, and it gives no workaround or detection guidance. The issue was closed as not planned on Jul 5, 2026. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/zylon-ai/private-gpt/issues/2269 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Zylon Zylon PrivateGPT NIST National Vulnerability DatabasePublished Oct 25, 2026 03:16 UTC Read the advisory
	Medium	6.9	CVE-2026-115999	A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 mansi-kmansi-k Restaurant_IMS	NVD	Oct 25 02:16 UTC
CVE-2026-115999A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 Executive summary A SQL injection flaw has been reported in mansi-k Restaurant_IMS, an open-source restaurant inventory management application, at a specific commit. The advisory does not state a severity score, and the vendor did not respond to early disclosure contact, so no fix is available from the vendor. Technical summary The flaw is a SQL injection in the mysqli_connect function of lsmodal.php, triggered by manipulating the login_id and epsw arguments. The advisory says remote exploitation is possible. Affected versions are not stated beyond the commit identifier d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694, because the project uses a rolling release model. No fixed version, workaround, CVSS score, or detection guidance is stated, and the vendor did not respond to disclosure. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects mansi-k mansi-k Restaurant_IMS NIST National Vulnerability DatabasePublished Oct 25, 2026 02:16 UTC Read the advisory
	Low	2.1	CVE-2026-115997	A flaw has been found in pig-mesh pig up to 4.1.0 pig-meshpig-mesh pig	NVD	Oct 25 00:16 UTC
CVE-2026-115997A flaw has been found in pig-mesh pig up to 4.1.0 Executive summary The advisory describes a flaw in pig-mesh pig, an open-source Java development platform, in versions up to 4.1.0. The text provided is mostly repository content and does not state the impact or severity of the flaw, and it gives no vendor recommendation. Technical summary The advisory is a brief NVD-style notice that a flaw exists in pig-mesh pig up to 4.1.0, but the excerpt is cut off before the vulnerability description. The vulnerability class, attack vector, and preconditions are not stated. No CVSS score, exploitation status, or fixed version is stated. The repository text mentions Pig version 4.1.2 as a dependency and core framework version, but it does not say this is a fixed release. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/pig-mesh/pig Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects pig-mesh pig-mesh pig NIST National Vulnerability DatabasePublished Oct 25, 2026 00:16 UTC Read the advisory
	Medium	6.3	CVE-2026-115996	A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1 Unitree RoboticsUnitree Robotics Unitree Go2	NVD	Oct 24 23:16 UTC
CVE-2026-115996A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1 Executive summary A vulnerability in the Unitree Go2 robot dog's chat component, affecting versions up to 1.1.13, 1.1.14.1, and 1.1.15.1, allows improper certificate validation. The advisory does not state a severity score, and it does not state a fix or recommended action from the vendor beyond confirming the issue was previously reported internally. Technical summary The flaw is improper certificate validation (CWE-295) in the WebSocketClient.connect function of websocket.py in the chat_go component, so the client does not properly verify the server's TLS certificate. The advisory says the attack may be initiated remotely, with high attack complexity and difficult exploitability. Affected versions are stated as up to 1.1.13/1.1.14.1/1.1.15.1, and a fixed version is not stated. A workaround is not stated, and detection guidance is not stated. The vendor quote references an internal ticket and submission number but gives no remediation details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Unitree Robotics Unitree Robotics Unitree Go2 NIST National Vulnerability DatabasePublished Oct 24, 2026 23:16 UTC Read the advisory
	Critical	9.4	CVE-2026-115995	A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4 Unitree RoboticsUnitree Robotics Unitree Go2	NVD	Oct 24 23:16 UTC
CVE-2026-115995A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4 Executive summary Unitree Robotics' Unitree Go2 robot, in versions up to 1.1.11.4, contains a vulnerability that can be exploited remotely. The advisory does not state a severity score, but it recommends upgrading to version 1.1.11.5 to resolve the issue. Technical summary The flaw is an OS command injection (CWE-78) in the set_volume function of gpt_thread.py in the chat_go component, triggered by manipulating the Value argument. The advisory says the attack can be launched remotely. The advisory does not state the specific preconditions, authentication requirements, or whether exploitation has occurred in the wild. The fixed version is 1.1.11.5, and the advisory says upgrading the affected component is sufficient. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Unitree Robotics Unitree Robotics Unitree Go2 NIST National Vulnerability DatabasePublished Oct 24, 2026 23:16 UTC Read the advisory
	Low	2.1	CVE-2026-115982	A vulnerability was detected in phpIPAM up to 1.8.3 phpipamphpipam	NVD	Oct 24 22:16 UTC
CVE-2026-115982A vulnerability was detected in phpIPAM up to 1.8.3 Executive summary A reflected cross-site scripting flaw affects phpIPAM versions up to and including 1.8.3. An attacker can craft a link that runs malicious scripts in the browser of a logged-in user who opens it, which could lead to session hijacking or unauthorized actions. The advisory states the maintainer confirmed a fix will be included in the next release, and no fixed version is stated. Technical summary The flaw is reflected cross-site scripting in app/tools/racks/show-rack-popup.php, where the deviceid parameter is passed to create_rack_link() and placed unescaped into an img src attribute. strip_tags() removes HTML tags but leaves double quotes and event handlers, so a crafted link can break out of the attribute and run JavaScript when a victim visits it. The advisory says an admin login is needed to reach the Racks feature by default, and the CVSS 3.1 base score of 4.2 (Medium) is given with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The suggested mitigation is validating deviceid with is_numeric() and escaping the output with escape_input(). A fixed version number is not stated, and no workaround or detection guidance beyond the proof of concept is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects phpipam phpipam NIST National Vulnerability DatabasePublished Oct 24, 2026 22:16 UTC Read the advisory
	Low	1.9	CVE-2026-115981	A security vulnerability has been detected in phpIPAM up to 1.8.3 phpipamphpipam	NVD	Oct 24 22:16 UTC
CVE-2026-115981A security vulnerability has been detected in phpIPAM up to 1.8.3 Executive summary A reflected cross-site scripting flaw affects phpIPAM versions 1.7.4 through 1.8.3 when run on PHP 7.x. An attacker who tricks a user into opening a crafted link could run scripts in that user's browser session, which could lead to session hijacking or unauthorized actions. The advisory gives the CVSS base score as 4.2 (Medium), and it does not state a vendor fix or workaround. Technical summary The flaw is reflected cross-site scripting in upgrade/index.php, where REQUEST_URI is printed into the HTML response without proper output encoding. The bug comes from a misplaced print inside the escape_input call, so the unescaped string is output before escaping runs, and the file also lacks the functions/functions.php include. The attack requires a victim to visit a crafted link, and the advisory states the CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The advisory says the issue affects phpIPAM 1.7.4 to 1.8.3 on PHP 7.x, and it says install/index.php was fixed in 1.7.4 (commit 181a12e), but it does not state a fixed version for upgrade/index.php. Workarounds and detection guidance are not stated, though the reporter suggests inverting the function nesting so escape_input() runs before print. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects phpipam phpipam NIST National Vulnerability DatabasePublished Oct 24, 2026 22:16 UTC Read the advisory
	None	n/a	cisco-sa-emudhra-info-ScS22A1r	Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities CiscoCisco IOS XR Software, Cisco Secure Firepower Management Center (FMC) Software, Cisco ThousandEyes Enterprise Agent, Cisco Duo Access Gateway, Cisco Duo Agentic Authorization Connector, Cisco Duo Network Gateway, Cisco Meraki Dashboard, Cisco Meraki MV Smart Camera Firmware, Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure	Cisco PSIRT	Oct 24 20:55 UTC
cisco-sa-emudhra-info-ScS22A1rCisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities Executive summary Cisco says eight intermediate certificates from the certificate authority eMudhra have weak private keys that can be brute-forced within seconds, so attackers could issue fraudulent TLS and code signing certificates. Cisco is still investigating its product line, and the advisory names a limited set of Cisco products as impacted, with some fixes or cloud remediation under way. Cisco recommends reviewing the vulnerable products table and applying the listed upgrades or remediation steps. Technical summary The flaw is a cryptographic key weakness: the private keys for eight eMudhra intermediate certificates were broken by an error in their April 2025 Key Generation Ceremony, so anyone can brute-force them, and the eight certificates were cross-signed by Sectigo's AAA Certificate Services root in May 2025. The advisory says the issue lets holders of these keys issue fraudulent TLS certificates for any domain and sign malicious code, and it states that a public announcement exists but that Cisco PSIRT is not aware of malicious use. The advisory lists target release dates and upgrade versions for some products, including Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1, IOS XR Software 26.4.1 (target Nov 30, 2026), and Ultra Cloud Core - Subscriber Microservices Infrastructure 2026.04.1 (Nov 2026), but it does not give fixed versions for every product. The header states no workarounds are available, and the advisory says any workarounds will be documented in the Vulnerable Products section. Secure Firepower Management Center has a Cisco TechZone article for configuring a TLS policy to block known eMudhra certificate issuers. Detection guidance beyond that is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…mudhra-info-ScS22A1r Score No CVSS score published. Affects Cisco Cisco IOS XR Software Cisco Secure Firepower Management Center (FMC) Software Cisco ThousandEyes Enterprise Agent Cisco Duo Access Gateway Cisco Duo Agentic Authorization Connector Cisco Duo Network Gateway Cisco Meraki Dashboard Cisco Meraki MV Smart Camera Firmware Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure Cisco Product Security Incident Response TeamPublished Oct 24, 2026 20:55 UTC Read the advisory
	Medium	6.9	CVE-2026-115973	A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3 faveosuitefaveosuite faveo-helpdesk	NVD	Oct 24 19:17 UTC
CVE-2026-115973A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3 Executive summary A weakness in the password recovery feature of FaveoSuite Faveo Helpdesk version 2.0.3 has been disclosed. The advisory does not state how severe the issue is or what fix is available, and it notes that the vendor was contacted early about the disclosure. Technical summary The advisory describes a weak password recovery flaw in ForgotPasswordController::sendResetLinkEmail and PasswordController::reset in app/Http/Controllers/Auth/ForgotPasswordController.php in Faveo Helpdesk 2.0.3. The advisory says the attack may be initiated remotely. It does not state the vulnerability class in detail, any preconditions, a CVSS score, a fixed version, a workaround, or whether exploitation has been observed. It also gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects faveosuite faveosuite faveo-helpdesk NIST National Vulnerability DatabasePublished Oct 24, 2026 19:17 UTC Read the advisory
	Critical	9.1	CVE-2026-114820	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) Oracle CorporationOracle Corporation Oracle Java SE, Oracle Corporation Oracle GraalVM for JDK, Oracle Corporation Oracle GraalVM Enterprise Edition	NVD	Oct 24 19:17 UTC
CVE-2026-114820Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) Executive summary A flaw in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition could let an unauthenticated attacker over the network access or change critical data. The advisory rates it 9.1 out of 10 under CVSS 3.1, which is critical severity. The advisory does not describe a fix or update recommendation in the text provided, so defenders should check the vendor's advisory for patch guidance. Technical summary The advisory describes a vulnerability in the JSSE (Java Secure Socket Extension) component that can be exploited through APIs, for example via a web service that supplies data to those APIs, and across multiple protocols over the network. No authentication or user interaction is required, and the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N with a base score of 9.1. Affected versions are listed as Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and Oracle GraalVM Enterprise Edition 21.3.20.0.2. The advisory also notes Java deployments such as sandboxed Web Start applications and applets that run untrusted code are affected. Fixed versions, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affects Oracle Corporation Oracle Corporation Oracle Java SE Oracle Corporation Oracle GraalVM for JDK Oracle Corporation Oracle GraalVM Enterprise Edition NIST National Vulnerability DatabasePublished Oct 24, 2026 19:17 UTC Read the advisory
	Medium	6.9	CVE-2026-115972	A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 faveosuitefaveosuite faveo-helpdesk	NVD	Oct 24 18:16 UTC
CVE-2026-115972A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 Executive summary A flaw has been found in FaveoSuite Faveo Helpdesk versions up to 2.0.3. The advisory says it lets someone change the status of helpdesk items without the proper authorization checks, and it can be attacked remotely. The advisory does not state a severity score or a vendor fix. Technical summary The weakness is missing authorization (CWE-type access control flaw) in the UnAuthController functions changeStatus, close, open, and resolve in app/Http/Controllers/Client/helpdesk/UnAuthController.php. An attacker can manipulate the id and status arguments to change ticket state remotely. The advisory says the vendor was contacted early about the disclosure. Affected versions are stated as up to 2.0.3. A fixed version is not stated, no workaround is stated, no detection guidance is stated, and whether the flaw is exploited in the wild is not stated. No CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects faveosuite faveosuite faveo-helpdesk NIST National Vulnerability DatabasePublished Oct 24, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-115971	A vulnerability was found in Travisun Opptrix 0.4.0 TravisunTravisun Opptrix	NVD	Oct 24 18:16 UTC
CVE-2026-115971A vulnerability was found in Travisun Opptrix 0.4.0 Executive summary A denial of service flaw was reported in Travisun Opptrix version 0.4.0, which can be triggered remotely and for which a public exploit exists. The project has been taken offline and deprecated, and the advisory states that the flaw only affects products no longer supported by the maintainer. Technical summary The advisory describes a denial of service issue in the Buffer.concat function within the preParsing handler for the /api/channels/webhook/ file in Travisun Opptrix 0.4.0. The attack can be launched remotely, and the advisory says a public exploit exists. The vulnerability class is given only as denial of service; the specific weakness type (such as CWE) is not stated. The maintainer says a fix was pushed to a private GitHub repository, but no fixed version number is stated, and no workaround, CVSS score, or detection guidance is stated. The advisory states the project is deprecated and taken offline, so no supported patched release is indicated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Travisun Travisun Opptrix NIST National Vulnerability DatabasePublished Oct 24, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-115970	A vulnerability has been found in Travisun Opptrix 0.4.0 TravisunTravisun Opptrix	NVD	Oct 24 18:16 UTC
CVE-2026-115970A vulnerability has been found in Travisun Opptrix 0.4.0 Executive summary A code injection flaw has been publicly reported in Travisun Opptrix version 0.4.0, and the exploit is public and may be used. The project has been taken offline and deprecated by its maintainer, and the advisory says the flaw only affects products no longer supported by the maintainer. Technical summary The advisory describes a code injection vulnerability in the Import Endpoint at the /api/system-update/import path of Travisun Opptrix 0.4.0, which can be triggered remotely. The advisory does not state the specific weakness identifier, authentication requirements, or the exact payload needed for exploitation. The maintainer states the issue was a design flaw that was fixed only in a private GitHub repository before the project went private, but no fixed version number is stated. No workaround, vendor patch version, CVSS score, or detection guidance is stated in the advisory. Because the project is deprecated and offline, the advisory recommends no specific remediation step beyond noting that it is no longer supported. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Travisun Travisun Opptrix NIST National Vulnerability DatabasePublished Oct 24, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-115969	A flaw has been found in Travisun Opptrix 0.4.0 TravisunTravisun Opptrix	NVD	Oct 24 16:16 UTC
CVE-2026-115969A flaw has been found in Travisun Opptrix 0.4.0 Executive summary A command injection flaw has been reported in Travisun Opptrix version 0.4.0, a scheduling application. The advisory says the exploit has been published and may be used, and that the project is now offline and deprecated. The advisory states that only products no longer supported by the maintainer are affected. Technical summary The flaw is a command injection issue in an unknown function of the /api/auth/setup file within the Schedule API component of Travisun Opptrix 0.4.0. The advisory says it can be started remotely and that a public exploit has been published. The maintainer states that the underlying design flaw was fixed in the GitHub repository before that repository went private, but no fixed version number is stated. No workarounds, CVSS score, detection guidance, or affected version range beyond 0.4.0 are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Travisun Travisun Opptrix NIST National Vulnerability DatabasePublished Oct 24, 2026 16:16 UTC Read the advisory
	Critical	9.9	CVE-2026-115933	Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for GitroomHQGitroomHQ postiz-app	NVD	Oct 24 15:17 UTC
CVE-2026-115933Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for Executive summary A flaw in the Postiz social media scheduling app (GitroomHQ postiz-app, versions 2.15.0 and later) lets any registered user forge trusted tokens and take over other users' accounts and organizations. The advisory rates it Critical with a CVSS v3.1 score of 9.9. The vendor's fix is to update to version 2.25.3, and until then the advisory recommends blocking the extension-refresh route and disabling self-registration, which reduce but do not remove the risk. Technical summary The root cause is that Postiz signs session, invitation and password reset tokens with one shared secret and no marker of their purpose, and a browser-extension credential refresh route signs request-controlled data and stores it where the user can read it back (CWE-290, CWE-345, CWE-915). An attacker needs only an ordinary self-registered account, with network access and no user interaction. Affected versions are stated as 2.15.0 and later, and the fix is in 2.25.3 (commit a5affe62). The advisory gives workarounds: block POST /integrations/extension-refresh at the reverse proxy, which does not close the team invitation route, and set DISABLE_REGISTRATION=true. Specific detection guidance is not stated. Whether the instance must reach api2.skool.com is stated as a configuration condition, and no exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gadvisory.org/advisories/PSA-2026-YT2HMH Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects GitroomHQ GitroomHQ postiz-app NIST National Vulnerability DatabasePublished Oct 24, 2026 15:17 UTC Read the advisory
	Critical	9.4	CVE-2026-115557	Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured Python, GoPython CPython, Go, Go crypto/x509	NVD	Oct 24 15:17 UTC
CVE-2026-115557Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured Executive summary The advisory covers a Go security fix that blocks trust in a small set of intermediate certificates from a specific Certificate Authority, delivered in Go 1.27.3 and Go 1.26.10. The Go team says it highly recommends immediately upgrading to these releases. The advisory does not state how severe the issue is. Technical summary The fix is in crypto/x509 and is described as a mitigation for security concerns with a specific Certificate Authority. Verify now filters out certificate chains that contain a small set of named intermediate certificates, so they are not returned to the caller. The advisory is tagged CVE-2026-111943 and references Go issue 82345. The attack vector, preconditions, and exploitation status are not stated. The affected version range is not stated, and no CVSS score is given. No workaround or detection guidance is stated beyond upgrading to Go 1.27.3 or Go 1.26.10. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from openwall.com/lists/oss-security/2026/10/20/29 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Python Go Python CPython Go Go crypto/x509 NIST National Vulnerability DatabasePublished Oct 24, 2026 15:17 UTC Read the advisory
	High	7.2	CVE-2026-114704	Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. Christoph Vielgrader, PatchstackChristoph Vielgrader Relevanssi, Patchstack Relevanssi	NVD	Oct 24 14:16 UTC
CVE-2026-114704Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. Executive summary A deserialization flaw in the Relevanssi WordPress plugin, versions through 4.28.4, lets attackers inject PHP objects. Patchstack rates it as medium priority with a CVSS severity of 7.2 and says it is expected to be exploited. The vendor-side recommendation is to update the plugin to version 4.28.5 or later. Technical summary The weakness is classified as PHP Object Injection, caused by deserialization of untrusted data, and the advisory says it allows object injection. The advisory states the required privilege is Editor, so an attacker needs an account with that role. Affected versions are listed as n/a through 4.28.4 by NVD and as 4.28.4 and earlier by Patchstack, and the patched version is 4.28.5. Patchstack has issued a mitigation rule that blocks attacks until the update is applied. The advisory does not state a workaround beyond the mitigation rule, and it does not give specific detection guidance or whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects Christoph Vielgrader Patchstack Christoph Vielgrader Relevanssi Patchstack Relevanssi NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114629	Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body... Web::SimpleWeb::Simple	NVD	Oct 24 14:16 UTC
CVE-2026-114629Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body... Executive summary Web::Simple versions before 0.035 for Perl have a flaw in how they handle urlencoded request bodies. The advisory states the flaw lets a request make the software allocate a buffer sized by the Content-Length header, and the advisory does not state a severity rating. Technical summary The weakness is an allocation based on an attacker-controlled Content-Length header for urlencoded request bodies, a resource exhaustion issue; the advisory does not name a specific CWE or CVSS score. The attack vector is a crafted HTTP POST, and the advisory does not state any further preconditions. The advisory says versions before 0.035 are affected; the fixed version is stated as 0.035 by the phrase 'versions before 0.035'. The patch reads urlencoded bodies in chunks, adds a configurable $Web::Dispatch::ParamParser::MAX_BODY_SIZE defaulting to 8 MiB, and croaks on oversized Content-Length values. The advisory does not state a workaround beyond the advice to validate Content-Length before dispatch, and it provides no detection guidance or information on exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/p5sagit/Web-Simple/commit/7e…fe6dc2679af695.patch Score No CVSS score published. Affects Web::Simple Web::Simple NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	Medium	6.5	CVE-2026-114192	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. WpEvently	NVD	Oct 24 14:16 UTC
CVE-2026-114192Missing Authorization vulnerability in Magepeople inc Executive summary A missing authorization flaw in the WpEvently WordPress plugin, made by Magepeople inc, lets users reach functions they should not be able to use. The advisory rates it CVSS 6.5 but says it is low priority and unlikely to be exploited. The vendor recommends updating the plugin to version 5.7.9 or later. Technical summary The weakness is classed as Broken Access Control (OWASP A1) in WpEvently plugin versions up to and including 5.7.8. The required privilege is listed as Unauthenticated, and the advisory does not describe the specific attack steps or endpoints. The patched version is 5.7.9, and the advisory recommends updating to that version or later, with hosting providers or developers as a fallback if updating is not possible. No workarounds are stated beyond updating, and no detection guidance, indicators of compromise, or evidence of exploitation in the wild is stated. The advisory gives CVSS 6.5 but does not provide a full CVSS vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects Magepeople inc.Magepeople inc. WpEvently NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	High	7.5	CVE-2026-114191	Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access... Knit PayKnit Pay UPI QR Code Payment Gateway for WooCommerce	NVD	Oct 24 14:16 UTC
CVE-2026-114191Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access... Executive summary A broken access control flaw in the UPI QR Code Payment Gateway for WooCommerce WordPress plugin, made by Knit Pay, lets people without logging in reach functions they should not use. The advisory rates it 7.5 CVSS and says it is expected to be exploited, and it recommends updating the plugin to version 1.7.0 or later. Technical summary The flaw is classified as Broken Access Control (missing authorization, OWASP A1) in the plugin's functions. The required privilege is stated as unauthenticated, so no account is needed. Vulnerable versions are stated as 1.6.3 and earlier (<= 1.6.3), and the patched version is 1.7.0. The advisory recommends updating to 1.7.0 or later. No workaround is given beyond updating, and Patchstack notes that no mitigation rule can be assigned for this flaw. The advisory does not state detection guidance, indicators of compromise, or whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affects Knit Pay Knit Pay UPI QR Code Payment Gateway for WooCommerce NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	Critical	9.6	CVE-2026-115932	When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory GitroomHQ, PostizGitroomHQ postiz-app, Postiz	NVD	Oct 24 13:16 UTC
CVE-2026-115932When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory Executive summary A path traversal flaw in Postiz (GitroomHQ postiz-app) lets any registered user read arbitrary files on the server and have them sent to a Discord server the user controls, when the Discord provider is enabled. The advisory rates it Critical with a CVSS v3.1 score of 9.6, and the vendor's fix is to upgrade to version 2.25.3 or later. Until then, the advisory recommends setting DISABLE_REGISTRATION to true, which reduces exposure but does not close the issue. Technical summary The flaw is classified as CWE-22 (path traversal) and CWE-74 (injection). When a post is published, a media path that is not a web address is treated as a local file without checking that it lies inside the upload directory, so an authenticated user with an ordinary account can have the publishing worker read arbitrary files and deliver them as attachments. The affected range is given as 2.23.0 or later (≥ 2.23.0), and the fixed version is 2.25.3. The main route requires DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET and DISCORD_BOT_TOKEN_ID to be set, and the validation-time route requires a Dribbble, TikTok or Pinterest provider; the advisory states that the worker runs as root in the shipped container. Mitigations are to set DISABLE_REGISTRATION=true and leave the Discord provider credentials unset, though the advisory says these only reduce reach. The advisory does not state any detection guidance, and the publicly referenced fix is commit 12db9bd. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gadvisory.org/advisories/PSA-2026-E9AHFV Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affects GitroomHQ Postiz GitroomHQ postiz-app Postiz NIST National Vulnerability DatabasePublished Oct 24, 2026 13:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116020	BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments... BookStackApp, BookStackBookStackApp BookStack, BookStack	NVD	Oct 24 12:16 UTC
CVE-2026-116020BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments... Executive summary BookStack, a documentation and wiki platform, has an authorization flaw that lets logged-in users reach attachments on other users' unpublished draft pages. The advisory does not state a severity score, but it notes that attackers can download, rename, relink, or replace these files. The fix is to upgrade BookStack to version 26.09.2 or later. Technical summary The flaw is an incorrect authorization issue (CWE-like access control failure) in the AttachmentController. An authenticated user who holds attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files attached to another user's draft pages. The advisory states affected versions as BookStack before 26.09.2 and the fixed version as 26.09.2. A CVSS score, workaround, detection guidance, and confirmation of in-the-wild exploitation are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects BookStackApp BookStack BookStackApp BookStack BookStack NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116019	Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with... getgrav, Gravgetgrav grav, Grav	NVD	Oct 24 12:16 UTC
CVE-2026-116019Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with... Executive summary The advisory says Grav CMS versions from 2.0.15 before 2.2.13 contain a flaw that lets users with page editing rights run arbitrary public static methods through blueprint directives. The text does not state a severity score. The advisory text does not state a vendor recommendation beyond the fix version shown in the description, so upgrading to 2.2.13 or later is the implied remedy. Technical summary The flaw is an allowlist bypass in Grav's handling of data-@ blueprint directives, which lets a page editor invoke arbitrary public static methods by relocating directives. The advisory excerpt is a source code listing of Blueprint.php with comments describing a fix, and it shows the allowlist and provenance checks that address the issue. The attack precondition is page editor access, and the excerpt does not state a CVSS score, exploitation status, or detection guidance. The affected range is stated as 2.0.15 before 2.2.13, and the fixed version is 2.2.13 as written in the description. Workarounds are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/getgrav/grav/blob/2.2.12/sys…n/Data/Blueprint.php Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav Grav getgrav grav Grav NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116018	ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read... ONEARMYONEARMY community-platform	NVD	Oct 24 12:16 UTC
CVE-2026-116018ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read... Executive summary ONEARMY community-platform versions before 2.165.2 contain a flaw that lets any logged-in user mark other users' notifications as read. The advisory does not state a severity rating or a score. The fix is to upgrade to version 2.165.2 or later. Technical summary The flaw is an insecure direct object reference (broken object-level authorization) in the notification read endpoint. The advisory says an authenticated user can change other users' notifications, and the code excerpt shows the update filters only on the notification ID with no check that the notification belongs to the calling user. Attack requires a valid authenticated session and knowledge or enumeration of notification IDs. The fixed version is stated as 2.165.2 (affected: before 2.165.2). The excerpt is from v2.163.2. Workarounds are not stated. Detection guidance is not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ONEARMY/community-platform/b…s.$id.read.ts#L6-L22 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ONEARMY ONEARMY community-platform NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116017	Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows... xinnan-tech, Xiaozhixinnan-tech xiaozhi-esp32-server, Xiaozhi-esp32-server	NVD	Oct 24 12:16 UTC
CVE-2026-116017Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows... From the advisory Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects xinnan-tech Xiaozhi xinnan-tech xiaozhi-esp32-server Xiaozhi-esp32-server NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	7.1	CVE-2026-116016	yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a... YunaiV, yudao-cloudYunaiV yudao-cloud, yudao-cloud	NVD	Oct 24 12:16 UTC
CVE-2026-116016yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a... Executive summary The advisory describes an authorization bypass in yudao-cloud through 2026.09 that lets authenticated users get around row-level data scope restrictions. The advisory excerpt does not state a severity rating, and it does not state what the vendor recommends. Technical summary The flaw is an authorization bypass (improper enforcement of row-level data scope) in yudao-cloud through 2026.09, reachable by any authenticated user. The excerpt shows that DataPermissionRpcWebFilter reads a request header and, when it equals false, runs the request chain inside DataPermissionUtils.executeIgnore, which appears to skip data permission checks; the advisory text itself does not explicitly link the header to the bypass, so this is inferred from the code shown. Affected versions are stated only as through 2026.09, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated in the excerpt. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YunaiV/yudao-cloud/blob/d322…bFilter.java#L21-L36 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV yudao-cloud YunaiV yudao-cloud yudao-cloud NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116015	yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members'... YunaiV, yudao-cloudYunaiV yudao-cloud, yudao-cloud	NVD	Oct 24 12:16 UTC
CVE-2026-116015yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members'... Executive summary The yudao-cloud platform through 2026.09 has a flaw in its mall trade module that lets a logged-in member read other members' data. The advisory is truncated and does not state a severity rating. It does not state a fix or vendor recommendation. Technical summary The flaw is an insecure direct object reference (broken object-level authorization) in the mall trade module. An authenticated member can read other members' records. The attached code excerpt shows the AppAfterSaleLogController /trade/after-sale-log/list endpoint, which takes an afterSaleId parameter and returns logs for that ID without any visible ownership check in the excerpt. Affected versions are stated only as through 2026.09, and no fixed version is stated. No CVSS score, workaround, or detection guidance is stated. Exploitation status is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YunaiV/yudao-cloud/blob/5933…troller.java#L33-L40 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV yudao-cloud YunaiV yudao-cloud yudao-cloud NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Critical	9.2	CVE-2026-116014	open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions open62541open62541	NVD	Oct 24 12:16 UTC
CVE-2026-116014open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions Executive summary An integer overflow in the open62541 OPC UA library affects versions 1.5.0 before 1.5.7 when it processes large custom structure definitions. The advisory describes the flaw as wrapping a 16-bit memory size field, but it does not state the severity or any CVSS score. The advisory does not say what the vendor recommends, though the affected version range implies that upgrading to 1.5.7 or later addresses it. Technical summary The flaw is an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field when a large custom structure definition is processed. The advisory does not state the attack vector, the preconditions for exploitation, or whether authentication is needed. The affected range is 1.5.0 before 1.5.7, and the fixed version is 1.5.7. The advisory does not state any workaround or detection guidance, and it does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open62541/open62541/blob/v1.…es_definition.c#L274 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects open62541 open62541 NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116013	OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths... openrestyopenresty lua-resty-dns	NVD	Oct 24 12:16 UTC
CVE-2026-116013OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths... Executive summary The advisory describes an input validation flaw in the OpenResty lua-resty-dns library, which fails to check DNS resource record lengths in its parsing functions. The text provided does not state how severe the flaw is or what fixed version is recommended beyond saying the library is affected before 0.24. Defenders should check whether they use lua-resty-dns and plan to upgrade to a release that includes the fix. Technical summary The flaw is an improper input validation issue in parse_section() and _decode_name(), which fail to check resource record lengths when parsing DNS responses. The advisory states the affected versions as before 0.24, but the file excerpt shows _VERSION as 0.22 and the page header refers to v0.23, and no fixed version is explicitly stated beyond the 0.24 boundary. The attack vector, required preconditions, exploitation status, CVSS score, workarounds, and detection guidance are not stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openresty/lua-resty-dns/blob…solver.lua#L396-L442 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openresty openresty lua-resty-dns NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Low	2.0	CVE-2026-116012	Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in... NationalSecurityAgency, GhidraNationalSecurityAgency ghidra, Ghidra	NVD	Oct 24 12:16 UTC
CVE-2026-116012Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in... Executive summary The advisory says Ghidra versions before 12.2 contain a numeric truncation flaw in its packed-data decoder, in the marshal.cc file. The advisory text does not state how severe the flaw is, and it does not give a CVSS score or describe any fix beyond the version boundary. Technical summary The flaw is described as a numeric truncation bug in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc, where 64-bit string lengths are stored in a narrower integer. The provided text shows the code, where readInteger returns a uint8 but skipAttribute and skipAttributeRemaining store the result in a uint4 length variable, which could cause incorrect skipping of data. The advisory text is cut off before its full description, so the attack vector, required preconditions, and exploitation status are not stated. The affected range is stated as before 12.2, but a fixed version number, workaround, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/NationalSecurityAgency/ghidr…marshal.cc#L641-L671 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects NationalSecurityAgency Ghidra NationalSecurityAgency ghidra Ghidra NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116011	Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply... CrowCpp, CrowCrowCpp Crow, Crow	NVD	Oct 24 12:16 UTC
CVE-2026-116011Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply... Executive summary The advisory says Crow versions before 1.3.4 contain an uncontrolled recursion flaw in the crow::json::load() function that lets a remote, unauthenticated attacker crash the server by sending deeply nested JSON. The text provided is truncated and does not state a severity score. The advisory does not state a vendor recommendation beyond the fixed version 1.3.4 in the description. Technical summary The flaw is classified as uncontrolled recursion in crow::json::load(), triggered by sending deeply nested JSON to a server, which can exhaust the stack and crash the process. The attack requires only remote, unauthenticated access as described. The affected range is stated as before 1.3.4, so 1.3.4 is the fixed version named. The source code excerpt shows a max_depth constant of 10000 in the parser, but the advisory does not explicitly state that this check is the fix or explain its effect. No workaround, CVSS score, exploitation status, or detection guidance is stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects CrowCpp Crow CrowCpp Crow Crow NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116010	RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by... francoisjacquet, RosarioSISfrancoisjacquet RosarioSIS, RosarioSIS	NVD	Oct 24 12:16 UTC
CVE-2026-116010RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by... Executive summary RosarioSIS versions before 12.9.1 contain a missing authorization flaw that lets logged-in teachers write records for students who are not in their course period. The advisory's text describes the issue as a fix to an insecure direct object reference in several attendance, referral, eligibility, and grade pages. Severity rating, exploitation status, and the vendor's formal recommendation are not stated beyond the fix shipped in version 12.9.1. Technical summary The weakness is a missing authorization check (insecure direct object reference, tracked as security fix #377) that allows an authenticated teacher to submit student IDs outside their own course period. The fix in TakeAttendance.php, MakeReferral.php, EnterEligibility.php and InputFinalGrades.php checks submitted student IDs against the schedule table for the current school year, school, and course period before writing. The advisory states that RosarioSIS before 12.9.1 is affected and that the fix is in 12.9.1, but it does not give a CVSS score, CWE identifier, or exploitation status. Workarounds and detection guidance are not stated. Admins can confirm exposure by checking whether their installation is at 12.9.1 or later. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gitlab.com/francoisjacquet/rosariosis/-…1bc969c7aea6626bab66 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects francoisjacquet RosarioSIS francoisjacquet RosarioSIS RosarioSIS NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116009	Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the... owen2345, Camaleon CMSowen2345 Camaleon CMS, Camaleon CMS	NVD	Oct 24 12:16 UTC
CVE-2026-116009Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the... Executive summary Camaleon CMS versions before 2.9.3 let a low-privileged user with only the media permission write arbitrary files to the server, which the advisory says can lead to running code on the server. The advisory states the CVSS 4.0 score is 8.7 (High). The advisory does not state a fixed version beyond the 'before 2.9.3' wording in the CVE description, and it does not describe a vendor-issued workaround. Technical summary The flaw is a path traversal in the media crop_url feature, where the file name taken from params[:name] is cleaned for the file name part but not the folder part, so ../ sequences can write files outside the upload folder. The data:// URL scheme passes the host-only IP validation, letting a user write attacker-supplied base64 content to disk, including an ERB template into the theme views folder that Camaleon renders when the page is viewed. Attack requires an authenticated user with only the media permission (PR:L, AT:N, UI:N per the CVSS vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The advisory states the version tested was Camaleon CMS v2.9.2 (commit c11e297a) and the CVE text says before 2.9.3. The advisory does not state an official fixed version, vendor workaround, or evidence of exploitation in the wild. Detection guidance is not stated beyond the proof-of-concept request details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects owen2345 Camaleon CMS owen2345 Camaleon CMS Camaleon CMS NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116008	DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without... Bottelet, DaybydayCRMBottelet DaybydayCRM, DaybydayCRM	NVD	Oct 24 12:16 UTC
CVE-2026-116008DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without... Executive summary DaybydayCRM through version 2.2.1 has a missing authorization flaw that lets any logged-in user reassign projects they should not control. The advisory describes the issue as a missing authorization check but does not state a severity rating or a score. The advisory does not state a fixed version or a vendor recommendation. Technical summary The flaw is a missing authorization check (CWE-style access control weakness) in the updateAssign() method of ProjectsController. Per the code shown, updateAssign() loads a project by external ID and sets user_assigned_id from the request without calling any permission check such as the can() checks used in other methods, so any authenticated user can reassign projects. The attack requires only a valid authenticated account. Affected versions are stated as through 2.2.1; a fixed version is not stated. A workaround is not stated. Exploitation in the wild is not stated, and no detection guidance is given beyond the vulnerable code shown. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Bottelet/DaybydayCRM/blob/2.…roller.php#L232-L245 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Bottelet DaybydayCRM Bottelet DaybydayCRM DaybydayCRM NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.8	CVE-2026-110018	The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all... Kodezen LLC, aBlocksKodezen LLC aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder, aBlocks	NVD	Oct 24 12:16 UTC
CVE-2026-110018The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all... Executive summary The aBlocks WordPress plugin, which adds block and form builder features, has a privilege escalation flaw in all versions up to and including 2.17.0. An authenticated user with Contributor-level access or higher could use it to raise their own role, up to Editor on a standard installation. The advisory does not state a CVSS score or a fixed version. Technical summary The flaw is a privilege escalation issue caused by a REST endpoint at /ablocks/v1/form-builder/registration that is registered with a permission callback of __return_true and reads roleSlug from block attributes stored in post_content without checking that formType is registration. A Contributor can save a block with formType set to login to preserve an arbitrary roleSlug, then trigger the endpoint using a valid wp_rest nonce and post ownership check, and receive an authenticated session at the elevated role via WP_User::set_role() and wp_set_auth_cookie(). The advisory states that is_safe_registration_role() blocks roles holding manage_options, edit_users, delete_users, create_users, promote_users, or edit_theme_options, so the highest reachable role is said to be Editor. The fixed version, vendor workaround, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Kodezen LLC aBlocks Kodezen LLC aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder aBlocks NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	4.3	CVE-2026-115998	IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from... CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 10:17 UTC
CVE-2026-115998IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from... Executive summary An access control flaw (IDOR) in Cervantes version v1.3-beta could let an authenticated user reach sensitive findings, proof-of-concept details, credentials, and client information. The advisory text is truncated and a related table lists several other Cervantes issues, with severities shown as Media, Baja, and Alta. The advisory does not state a fix or vendor recommendation. Technical summary The primary issue is an insecure direct object reference (IDOR) in Cervantes v1.3-beta, which the advisory says an authenticated attacker could use to access other users' data. The advisory's text is truncated, so the full attack preconditions are not stated. A related table also lists a broken object level authorization issue allowing cross-project target tampering, a stored XSS in the Notes field of project checklists, and broken access control in JiraController, with both Baja and Alta severity entries for CVE-2026-115975. Fixed versions, workarounds, and detection guidance are not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	5.4	CVE-2026-115994	BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization,... CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 10:17 UTC
CVE-2026-115994BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization,... Executive summary A flaw in Cervantes version v1.3-beta could let an attacker change or delete targets that belong to other projects without permission. The advisory describes the severity as Media (medium) in the listing table. The advisory does not state a vendor fix or recommended action beyond the description. Technical summary The flaw is a broken object level authorization (BOLA) issue, which allows cross-project target tampering in Cervantes v1.3-beta. An attacker can modify or delete targets belonging to other projects without authorization. The advisory does not state the attack preconditions, such as whether authentication is required. No fixed version, workaround, CVSS score, or detection guidance is stated in the advisory text provided. The related listing also shows other unrelated entries, which are not part of this advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	6.5	CVE-2026-114705	Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue... quadlayersquadlayers WP Social Feed Gallery	NVD	Oct 24 10:17 UTC
CVE-2026-114705Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue... Executive summary A broken access control flaw in the WP Social Feed Gallery WordPress plugin, versions 5.0.13 and earlier, lets users reach pages or actions they should not be allowed to use. The advisory rates it medium priority with a CVSS score of 6.5 and says it is expected to be exploited. The recommended action is to update the plugin, or ask a hosting provider or web developer for help if that is not possible. Technical summary The issue is classified as Broken Access Control, under OWASP A1, and is described as a Missing Authorization vulnerability. The advisory states that it affects WP Social Feed Gallery versions less than or equal to 5.0.13, and that the required privilege is unauthenticated. No official patch is listed as available, and no fixed version is stated. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released, which the advisory presents as the interim workaround. The advisory does not state specific exploit details or attack steps, and it gives no detection guidance beyond the mitigation rule. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects quadlayers quadlayers WP Social Feed Gallery NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	6.5	CVE-2026-114194	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects... Igor Funa, WordPressIgor Funa Ad Inserter, WordPress Ad Inserter Plugin	NVD	Oct 24 10:17 UTC
CVE-2026-114194Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects... From the advisory Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects Igor Funa WordPress Igor Funa Ad Inserter WordPress Ad Inserter Plugin NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	6.8	CVE-2026-115993	Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with... CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 09:16 UTC
CVE-2026-115993Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with... Executive summary A stored cross-site scripting flaw affects the Notes field of Checklists in Cervantes version v1.3-beta. The advisory says an attacker could run code in another user's browser, and it rates the issue as Media severity. Technical summary The flaw is stored cross-site scripting in the Notes field of Checklists, which allows arbitrary script execution in another user's browser. The advisory text is truncated, so the attack vector and user interaction required are not fully stated. The vendor and fixed version are not stated, and no workaround or detection guidance is given. The table in the advisory lists the same CVE as Media severity, dated 24 oct 2026, with the description 'Stored XSS in the Notes field of project checklists.' No CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 09:16 UTC Read the advisory
	Critical	9.8	CVE-2026-94075	Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1. Tribulant SoftwareTribulant Software Newsletters	NVD	Oct 24 08:16 UTC
CVE-2026-94075Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1. Executive summary A deserialization flaw in the Newsletters WordPress plugin by Tribulant Software lets unauthenticated attackers run harmful code on affected websites. The advisory rates it 9.8 out of 10 severity and says it is expected to be exploited in mass attack campaigns. The recommended action is to update the plugin to version 4.18.2 or later. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, classified as OWASP A3 Injection. The advisory states it requires no privileges (unauthenticated) and gives a CVSS severity of 9.8, with the affected range listed as through 4.18.1 and the patched version as 4.18.2. The advisory describes the attack vector only in general terms and does not give the specific vulnerable parameter or request. Workarounds are not stated beyond a Patchstack mitigation rule that blocks attacks, and the vendor's own fix is updating to 4.18.2 or later. No detection guidance, indicators of compromise, or confirmation of active exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Tribulant Software Tribulant Software Newsletters NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-115975	Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 08:16 UTC
CVE-2026-115975Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects Executive summary A broken access control flaw in the JiraController component of Cervantes v1.3-beta could let an attacker create, edit, or delete Jira tickets for vulnerabilities belonging to other projects. The advisory text includes a severity table with entries marked both Alta (high) and Baja (low) for this CVE, so the overall severity is unclear from the text. The advisory does not state a vendor fix or recommended remediation. Technical summary The flaw is a broken access control issue (authorization bypass) in JiraController in Cervantes v1.3-beta, allowing modification of Jira tickets tied to other projects. The advisory does not state the attack vector, required privileges, or user interaction needed, though the description implies an authenticated or reachable attacker. No fixed version, workaround, or detection guidance is stated. The embedded table lists this CVE twice with severities Baja and Alta, and the advisory does not explain the discrepancy. A related table entry lists different CVEs (CVE-2026-115998, CVE-2026-115994, CVE-2026-115993) that are not clearly tied to this advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114697	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue... QuarkA, PatchstackQuarkA QA Analytics, Patchstack QA Analytics	NVD	Oct 24 08:16 UTC
CVE-2026-114697Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue... Executive summary A cross-site scripting flaw in the QA Analytics WordPress plugin, versions 5.3.0.1 and earlier, lets attackers inject malicious scripts into affected websites. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The recommended action is to update the plugin to version 5.3.0.2 or later. Technical summary This is a stored cross-site scripting (XSS) vulnerability, classified under OWASP A3: Injection, in the QA Analytics plugin for WordPress. The advisory states that vulnerable versions are 5.3.0.1 and earlier and that the patched version is 5.3.0.2. Exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form, while the attacker needs no authentication. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, but the advisory does not describe other workarounds. Detection guidance beyond the mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects QuarkA Patchstack QuarkA QA Analytics Patchstack QA Analytics NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114695	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This... Infomaniak NetworkInfomaniak Network VOD Infomaniak	NVD	Oct 24 08:16 UTC
CVE-2026-114695Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This... Executive summary A cross-site scripting flaw affects the VOD Infomaniak WordPress plugin, versions 1.5.14 and earlier. Patchstack rates it medium priority with a CVSS severity of 7.1 and says attackers could use it to steal visitor data or hijack accounts. The vendor-side recommendation is to update the plugin to version 1.5.15 or later. Technical summary This is a stored cross-site scripting (XSS) vulnerability in the VOD Infomaniak WordPress plugin, classified under OWASP A3: Injection. The advisory states that the required privilege is unauthenticated, but that exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are stated as <= 1.5.14 and the patched version is 1.5.15. Patchstack has issued a mitigation rule to block attacks until the plugin is updated, and it advises auto-update for vulnerable plugins. The advisory does not state any further workaround, the exact vector string, or detection guidance, and it does not state whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Infomaniak Network Infomaniak Network VOD Infomaniak NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114694	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue... Pixelite, PatchstackPixelite Events Manager	NVD	Oct 24 08:16 UTC
CVE-2026-114694Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue... Executive summary A cross-site scripting flaw affects the Events Manager WordPress plugin up to version 7.4.8. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited, and it recommends updating the plugin to version 7.4.9 or later. Technical summary The flaw is a reflected cross-site scripting (XSS) issue classified under OWASP A3: Injection, which lets injected scripts run in a visitor's browser. The advisory lists the required privilege as unauthenticated but says exploitation requires a privileged user to take an action such as clicking a malicious link or visiting a crafted page. Vulnerable versions are stated as 7.4.8 and earlier, and the patched version is 7.4.9. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any further workarounds or specific detection guidance beyond updating and the mitigation rule. It does not state whether exploitation in the wild has been confirmed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Pixelite Patchstack Pixelite Events Manager NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Medium	6.5	CVE-2026-114693	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows... Plugins360 Labs, PatchstackPlugins360 Labs All-in-One Video Gallery, Patchstack All-in-One Video Gallery	NVD	Oct 24 08:16 UTC
CVE-2026-114693Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows... Executive summary A cross-site scripting flaw affects the WordPress All-in-One Video Gallery plugin, versions 4.9.7 and earlier. The publisher Patchstack rates it medium priority with a CVSS score of 6.5. The recommended action is to update the plugin to version 5.0.0 or later. Technical summary The advisory classifies this as cross-site scripting (XSS), which Patchstack maps to OWASP A3: Injection. Exploitation requires a privileged user, with the required privilege listed as Subscriber, to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are 4.9.7 and earlier, and the patched version is 5.0.0. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, and it states that the vulnerability is expected to become exploited. The advisory does not state any detection indicators or additional workarounds beyond the update and mitigation rule. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects Plugins360 Labs Patchstack Plugins360 Labs All-in-One Video Gallery Patchstack All-in-One Video Gallery NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.8	CVE-2026-114196	Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. paytiumsupport, Patchstackpaytiumsupport Paytium	NVD	Oct 24 08:16 UTC
CVE-2026-114196Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. Executive summary A deserialization flaw in the Paytium WordPress plugin, versions up to and including 5.0.5, lets unauthenticated attackers inject PHP objects. The advisory rates it critical at CVSS 9.8 and says it is expected to be exploited in mass campaigns. The vendor recommends updating the plugin to version 5.0.6 or later. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, classified as OWASP A3: Injection. The advisory states the attack requires no privileges (unauthenticated) and gives a CVSS score of 9.8. Affected versions are stated as n/a through 5.0.5 and <= 5.0.5, with the patched version 5.0.6. The advisory says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated, but it does not describe a manual workaround, the specific vulnerable code path, or indicators of compromise and detection guidance. Whether exploitation in the wild has been observed is not stated beyond the expectation that it will be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects paytiumsupport Patchstack paytiumsupport Paytium NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Medium	5.9	CVE-2026-114190	Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This... Hai Zheng / Lite Speed Cache, Hai ZhengHai Zheng / Lite Speed Cache LiteSpeed Cache, Hai Zheng LiteSpeed Cache	NVD	Oct 24 08:16 UTC
CVE-2026-114190Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This... Executive summary A sensitive data exposure flaw affects the LiteSpeed Cache WordPress plugin, versions 7.9 and earlier. The advisory rates it medium priority with a CVSS severity of 5.9 and says attackers use this class of flaw in mass-exploit campaigns. The recommended action is to update the plugin to version 7.9.1 or later. Technical summary The advisory describes an insertion of sensitive information into sent data vulnerability, classified as Sensitive Data Exposure (OWASP A3), in the LiteSpeed Cache plugin by Hai Zheng. The required privilege is stated as unauthenticated, so no account is needed to exploit it. Vulnerable versions are <= 7.9 and the patched version is 7.9.1. The advisory recommends updating to 7.9.1 or later and notes that no virtual patch rule can be assigned, so updating is the only listed mitigation. Workarounds beyond updating, the specific data exposed in the response, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affects Hai Zheng / Lite Speed Cache Hai Zheng Hai Zheng / Lite Speed Cache LiteSpeed Cache Hai Zheng LiteSpeed Cache NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114179	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This... wordpluswordplus BP Better Messages	NVD	Oct 24 08:16 UTC
CVE-2026-114179Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This... Executive summary A cross-site scripting flaw affects the BP Better Messages WordPress plugin, versions 3.1.3 and earlier. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited, and it recommends updating the plugin to version 3.1.4 or later. Technical summary The flaw is a cross-site scripting (XSS) issue, classed as improper neutralization of input during web page generation, described as DOM-based. The advisory says it can be started by an unauthenticated user, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page. Vulnerable versions are stated as 3.1.3 and earlier, and the patched version is 3.1.4. The advisory recommends updating to 3.1.4 or later and says Patchstack has issued a mitigation rule that blocks attacks until the site is patched. Workarounds beyond the mitigation rule are not stated, and no detection guidance or indicators of compromise are given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects wordplus wordplus BP Better Messages NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114178	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue... Bold GridBold Grid W3 Total Cache	NVD	Oct 24 08:16 UTC
CVE-2026-114178Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue... Executive summary A cross-site scripting flaw affects the W3 Total Cache WordPress plugin by Bold Grid, in versions up to and including 2.10.7. The advisory rates it as medium priority with a CVSS severity of 7.1 and says attackers could inject scripts that steal visitor data or hijack accounts. The recommended fix is to update the plugin to version 2.11.0 or later. Technical summary The flaw is a stored cross-site scripting (XSS) issue classified under OWASP A3: Injection, caused by improper neutralization of input during web page generation. The advisory lists the required privilege as unauthenticated, but says exploitation requires a privileged user to take an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are stated as <= 2.10.7 and the patched version as 2.11.0. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, and it recommends updating to 2.11.0 or later. The advisory does not state any further workarounds or specific detection guidance beyond this. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Bold Grid Bold Grid W3 Total Cache NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-112869	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue... Noah Hearle, PatchstackNoah Hearle We’re Open!, Patchstack We're Open!	NVD	Oct 24 08:16 UTC
CVE-2026-112869Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue... Executive summary A cross-site scripting flaw affects the We're Open! opening-hours plugin for WordPress, versions 2.6 and earlier. The advisory rates it as medium priority with a CVSS severity of 7.1 and says attackers could use it to steal visitor data or hijack accounts. The vendor recommends updating the plugin to version 2.7 or later. Technical summary This is a reflected cross-site scripting (XSS) vulnerability classed as OWASP A3: Injection. The advisory states that it can be started by an unauthenticated user, but a privileged user must take an action such as clicking a malicious link or submitting a form for exploitation to succeed. Vulnerable versions are listed as 2.6 and earlier, and the patched version is 2.7. The advisory recommends updating to 2.7 or later and notes that Patchstack has issued a mitigation rule that blocks attacks until the update is applied. It does not state a manual workaround beyond that, nor does it state whether exploitation has been observed in the wild, and it gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Noah Hearle Patchstack Noah Hearle We’re Open!Patchstack We're Open! NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.3	CVE-2026-112866	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL... WPFactoryWPFactory Product Filter by WBW	NVD	Oct 24 08:16 UTC
CVE-2026-112866Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL... Executive summary A SQL injection flaw in the Product Filter by WBW WordPress plugin, made by WPFactory, lets attackers read, change, or delete data in a website's database. The advisory rates it 9.3 on the CVSS scale and says it is highly dangerous and expected to become exploited. The recommended fix is to update the plugin to version 3.4.7 or later. Technical summary The weakness is classified as SQL Injection (OWASP A3: Injection), and the advisory states that it can be exploited without authentication (required privilege: unauthenticated). Vulnerable versions are listed as 3.4.6 and earlier, with 3.4.7 as the patched version. The advisory describes the impact as the ability to read, modify, or delete the entire database, but does not give technical details of the injection point, request format, or exploit steps. Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated, and the advisory says the vendor recommends updating to 3.4.7 or later. Workarounds beyond the Patchstack rule and update, and specific detection guidance, are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affects WPFactory WPFactory Product Filter by WBW NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-112844	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue... arrayticsarraytics WP Event Solution	NVD	Oct 24 08:16 UTC
CVE-2026-112844Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue... Executive summary A cross-site scripting flaw in the WP Event Solution WordPress plugin, made by Arraytics, lets attackers inject malicious scripts into affected websites. The advisory rates it as medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The vendor recommends updating the plugin to version 4.1.27 or later. Technical summary This is a stored cross-site scripting (XSS) vulnerability classified under OWASP A3: Injection. The advisory states the required privilege is unauthenticated, but also that successful exploitation requires a privileged user to perform an action such as clicking a malicious link or submitting a form. Vulnerable versions are listed as 4.1.26 and earlier, and the patched version is 4.1.27. The advisory recommends updating to 4.1.27 or later and says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated. Workarounds beyond the mitigation rule and any detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects arraytics arraytics WP Event Solution NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.3	CVE-2026-111402	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This... Tribulant Software, PatchstackTribulant Software Newsletters	NVD	Oct 24 08:16 UTC
CVE-2026-111402Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This... Executive summary A SQL injection flaw affects the Newsletters plugin for WordPress, made by Tribulant Software, in versions 4.18.1 and earlier. The publisher rates it 9.3 on CVSS and says it is highly dangerous and likely to be used in mass-exploit campaigns, so the advisory recommends updating the plugin to version 4.18.2 or later right away. Technical summary This is an SQL injection vulnerability (OWASP A3: Injection) in the Newsletters WordPress plugin, versions 4.18.1 and earlier, with a CVSS severity of 9.3 and a Patchstack priority of High. The advisory states that it can be exploited by an unauthenticated attacker, and that successful exploitation could let an attacker read, modify, or delete the entire database, including user accounts and private data. The patched version is 4.18.2, and the advisory says to update to 4.18.2 or later. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any other workarounds, and it does not give specific detection guidance or indicate whether exploitation has been observed in the wild beyond saying it is expected to become exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affects Tribulant Software Patchstack Tribulant Software Newsletters NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Medium	6.5	CVE-2026-110892	Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash:... Brainstorm ForceBrainstorm Force SureDash	NVD	Oct 24 08:16 UTC
CVE-2026-110892Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash:... Executive summary A broken access control flaw in the SureDash WordPress plugin, made by Brainstorm Force, lets users reach pages or actions they should not be able to use. The advisory rates it at CVSS 6.5 but says it has low severity impact and is unlikely to be exploited. The vendor's recommended fix is to update the plugin to version 1.12.3 or later. Technical summary The weakness is classified as Broken Access Control, with a missing authorization check described in the advisory. The advisory states the affected versions are 1.12.2 and earlier, and the patched version is 1.12.3. The required privilege is Subscriber, so an authenticated low-privilege account is the stated precondition. The advisory does not state any workaround other than updating, and it does not give detection guidance or indicate whether exploitation has been observed in the wild. The CVSS vector string is not stated; only the score of 6.5 is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…rability-3?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Brainstorm Force Brainstorm Force SureDash NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Low	2.1	CVE-2026-115803	A flaw has been found in Scada-LTS 2.8.0 Scada-LTS, AmChartsScada-LTS, AmCharts Data API	NVD	Oct 24 07:16 UTC
CVE-2026-115803A flaw has been found in Scada-LTS 2.8.0 Executive summary A flaw has been found in Scada-LTS version 2.8.0, an industrial control system monitoring product. The advisory says the flaw can allow authorization bypass and that a public exploit has been published. The vendor says a new release with security enhancements is in development but has not yet been released. Technical summary The weakness is an authorization bypass in the AmCharts Data API component, specifically in the AmChartValuesAPI.java file where HttpServletRequest.getParameter handles the ids argument. The attack can be launched remotely by manipulating the ids argument; the advisory does not state any authentication preconditions. Affected versions are stated as Scada-LTS 2.8.0 only, and no fixed version is stated. The vendor says a new release with security enhancements is in progress and will be introduced soon. No workaround, detection guidance, CVSS score, or in-the-wild exploitation status is stated, though the advisory says an exploit has been published and may be used. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Scada-LTS AmCharts Scada-LTS AmCharts Data API NIST National Vulnerability DatabasePublished Oct 24, 2026 07:16 UTC Read the advisory
	Low	2.1	CVE-2026-115802	A weakness has been identified in InternScience InternAgent 1.5.0 InternScienceInternScience InternAgent	NVD	Oct 24 07:16 UTC
CVE-2026-115802A weakness has been identified in InternScience InternAgent 1.5.0 Executive summary A weakness has been identified in InternScience InternAgent 1.5.0, an open-source agentic framework for autonomous scientific research. The advisory text provided does not describe the severity of the weakness, and the advisory does not state a fix or vendor recommendation. Technical summary The advisory text is a copy of the InternAgent GitHub repository page and only states that a weakness exists in InternAgent 1.5.0. The vulnerability class, attack vector, and preconditions are not stated. Affected version range beyond 1.5.0, fixed version, workaround, CVSS score, exploitation status, and detection guidance are not stated. Defenders should consult the NVD entry and the vendor repository for technical details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/InternScience/InternAgent Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects InternScience InternScience InternAgent NIST National Vulnerability DatabasePublished Oct 24, 2026 07:16 UTC Read the advisory
	Medium	6.8	CVE-2026-108013	BigFix Platform uses Mozilla CA certificate bundle (PEM) HCL Software, BigFix, MozillaHCL Software BigFix Platform, BigFix Platform, Mozilla CA certificate bundle	NVD	Oct 24 07:16 UTC
CVE-2026-108013BigFix Platform uses Mozilla CA certificate bundle (PEM) Executive summary The advisory says that the BigFix Platform ships an outdated Mozilla CA certificate bundle that still trusts certificates whose private keys have been compromised. An attacker positioned between the product and a server could impersonate that server and tamper with files the product downloads. The advisory states the fix is to use a bundle dated 2026/10/20 or later, available starting from BES Support v1520. Technical summary This is a trust validation weakness caused by an outdated certificate authority bundle in the BigFix Platform. Bundles dated before 2026/10/20 still trust certificates whose private keys are compromised, so an on-path attacker can impersonate remote servers during validation. The attack requires a network position between the product and the target server, and the advisory describes file tampering as the impact. The fix is bundle version 2026/10/20 or later, available starting from BES Support v1520. The advisory does not state a CVSS score, exploitation status, or any workaround, and it does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects HCL Software BigFix Mozilla HCL Software BigFix Platform BigFix Platform Mozilla CA certificate bundle NIST National Vulnerability DatabasePublished Oct 24, 2026 07:16 UTC Read the advisory
	Medium	5.4	CVE-2026-97353	The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX... News KitNews Kit Addons For Elementor	NVD	Oct 24 06:16 UTC
CVE-2026-97353The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX... Executive summary The News Kit Addons For Elementor WordPress plugin, through version 1.4.7, has a flaw that lets users without the right permissions change post data. The advisory rates it medium severity with a CVSS score of 5.4, and it states no known fix is available. Technical summary The flaw is a missing authorization (broken access control, CWE-862) in one of the plugin's authenticated AJAX actions, which does not check user capability or ownership before updating post metadata. The advisory does not state the exact attacker privilege level required beyond being authenticated, though the vulnerable endpoint is described as authenticated. Affected versions are listed as through 1.4.7, and no fixed version is stated. No workaround is stated, and no detection guidance is provided. The advisory also lists several unrelated plugin titles in its Other section, which are not part of this flaw. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/4114e6a4-d8ed-…56-a15f-4d47034ae75f Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects News Kit News Kit Addons For Elementor NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	4.3	CVE-2026-97352	The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with... News Kit Addons For ElementorNews Kit Addons For Elementor news-kit-elementor-addons	NVD	Oct 24 06:16 UTC
CVE-2026-97352The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with... Executive summary The News Kit Addons For Elementor WordPress plugin contains a flaw that lets logged-in users perform actions they should not be allowed to perform. The advisory rates it medium severity with a CVSS score of 4.3, and the fix is to update the plugin to version 1.4.9 or later. Technical summary The flaw is a missing authorization (broken access control, CWE-862) caused by the plugin not performing a capability check on one of its AJAX actions. The advisory says authenticated users with low-level access can exploit it, and the advisory text is cut off before it fully describes the required privileges. The affected version range is stated as before 1.4.9, and the fixed version is 1.4.9. The advisory does not state a workaround. It also does not state whether exploitation has been observed in the wild, and no detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/36f192be-f684-…4c-8b37-9dd006407b6f Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects News Kit Addons For Elementor News Kit Addons For Elementor news-kit-elementor-addons NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.5	CVE-2026-87835	The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing... Front End UsersFront End Users	NVD	Oct 24 06:16 UTC
CVE-2026-87835The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing... Executive summary The Front End Users WordPress plugin, through version 3.2.35, lets a website visitor set account attributes they should not control when they register through the front-end forms. The advisory does not give a severity rating from the vendor, though a CVSS score of 6.4 (medium) is listed, and it states no known fix is available. Technical summary The weakness is classified as broken access control (CWE-284): the plugin does not restrict which account attributes a visitor may set during front-end registration. The advisory text is truncated after the words 'allowing...', so the full impact is not stated. The attack vector is listed as network-reachable registration forms, but any required privileges, user interaction, or exact exploitation steps are not stated. The affected version is through 3.2.35, and a fixed version is not stated because the advisory says there is no known fix. Workarounds and detection guidance are not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/9a761c19-1608-…f7-9ab3-f92f3fc0aadf Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects Front End Users Front End Users NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-114429	The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could... WPVRWPVR	NVD	Oct 24 06:16 UTC
CVE-2026-114429The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could... Executive summary The WPVR WordPress plugin, versions before 9.0.3, contains a flaw that could let attackers inject malicious scripts into pages shown to visitors. The advisory rates it as medium severity, with a CVSS score of 6.8, and the fix is to update to version 9.0.3. Technical summary The flaw is a cross-site scripting (XSS) issue, classified as CWE-79, in which tour hotspot content is not properly sanitised or escaped before it is stored and output on the front end. The advisory does not state the exact attack preconditions beyond the description that the flaw could be exploited, so the required privilege level is not stated in the provided text. The affected version range is stated as before 9.0.3, and the fixed version is 9.0.3. The advisory does not state any workaround, and it gives no detection guidance or information on exploitation in the wild. The CVSS score is listed as 6.8 (medium), and the advisory does not provide a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/30409336-b8ed-…f7-bc40-96c21f494155 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Low	3.7	CVE-2026-113674	The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113674The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets logged-out users edit listings they do not own. The advisory rates the issue low severity with a CVSS score of 3.7 and says the fix is in version 2.8.194. Site owners should update the plugin to 2.8.194 or later. Technical summary The flaw is a broken access control issue (CWE-284) in which the plugin does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. The advisory says the issue allows unauthorized edits, and the snippet is truncated so the full impact is not shown. The vulnerable versions are described as those before 2.8.194, and the fixed version is 2.8.194. The CVSS score is 3.7 (low) as stated. No workaround, exploitation status in the wild, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/23e66ca1-50eb-…c1-9f5f-f830235c5af0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	High	7.2	CVE-2026-113673	The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113673The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets an administrator-defined text value be written unsafely into a generated PHP file. The advisory rates it high severity with a CVSS score of 7.2 and says the fix is to update to version 2.8.194. Technical summary The weakness is classified as CWE-94 (code injection) and as remote code execution, and the advisory states that administrator-defined text is not properly escaped before it is written into a generated PHP file in the plugin's own folder. The advisory text is truncated, so the attack vector and preconditions beyond the administrator-defined input are not fully stated. Affected versions are stated as before 2.8.194, and the fixed version is 2.8.194. Workarounds are not stated. Detection guidance is not stated. The CVSS vector string is not stated; only the score of 7.2 (high) is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7ef117ed-1fd6-…e6-b242-87a7b65d3477 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-113493	The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113493The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing... Executive summary The GeoDirectory WordPress plugin, before version 2.8.194, contains a cross-site scripting flaw in its map shortcode handling. The advisory rates it medium severity (CVSS 6.8, as listed) and the fix is to update the plugin to 2.8.194 or later. Technical summary The flaw is cross-site scripting (CWE-79) caused by the plugin not sanitising or escaping some map shortcode attributes before outputting them inside a style attribute. The advisory's text is truncated, so the attack vector and required privileges are not fully stated. The fixed version is 2.8.194, and the advisory lists the plugin as before that version. Workarounds are not stated. Detection guidance is not stated. The listed CVSS score of 6.8 (medium) comes from the advisory's metadata. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/a46bd6e9-4037-…13-b36d-e418a2ed41b7 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.3	CVE-2026-113492	The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers,... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113492The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers,... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that can expose sensitive data to people who are not logged in. The advisory rates it medium severity with a CVSS score of 5.3. The fix is to update the plugin to version 2.8.194 or later. Technical summary The flaw is a sensitive data disclosure, classified as CWE-200, in which one of the plugin's unauthenticated AJAX handlers loads listings without performing status, ownership, or password checks. The advisory states it can be reached without authentication, and the affected version range is given only as before 2.8.194. The fixed version is 2.8.194. The advisory does not state any workaround. It does not state whether exploitation in the wild has been observed, and it gives no detection guidance. The advisory text is truncated, so the full description of the affected handler is not available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/5a1c17a0-c513-…64-91c7-09c0f1878c71 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.4	CVE-2026-113491	The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113491The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a path traversal flaw that can allow an attacker to misuse file handling on a website. The advisory lists the fix as version 2.8.194 and gives a medium severity score of 6.4, with no further impact details stated. Technical summary The flaw is a path traversal (CWE-22) in the GeoDirectory WordPress plugin before 2.8.194, where a user-supplied image URL is used as a local file path when saving a front-end listing without validation. The advisory states the issue allows access through this path, but the exact impact is cut off in the text. The attack vector, required privileges, and user interaction are not stated. The fixed version is 2.8.194, and the advisory lists a CVSS score of 6.4 (medium). No workaround and no detection guidance are stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ba2114a5-01e3-…e7-a7f6-673674b6501d Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.3	CVE-2026-113490	The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113490The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST... Executive summary The GeoDirectory WordPress plugin, before version 2.8.194, can expose information about listings to people who should not see it. The advisory rates the issue medium severity with a CVSS score of 5.3, and the fix is to update to version 2.8.194. Technical summary The flaw is a missing status or ownership check (CWE-200, sensitive information disclosure) when a listing's map popup is rendered through a single-item REST endpoint in the GeoDirectory plugin. The advisory states the plugin is affected before 2.8.194 and fixed in 2.8.194. The attack vector, required privileges, and exact data exposed are not stated beyond the classification. Workarounds are not stated. Detection guidance is not stated. The CVSS score given is 5.3 (medium). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2901f8f3-0b35-…65-b248-6c0dfc5de894 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	4.3	CVE-2026-113489	The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113489The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets low-privileged logged-in users (Subscriber level) reference attachments they do not own when saving a listing. The advisory rates it medium severity with a CVSS score of 4.3, and the fix is to update the plugin to version 2.8.194. Technical summary The weakness is an insecure direct object reference (CWE-639, broken access control) in which the plugin does not verify that a referenced attachment belongs to the listing being saved. The attack requires an account with Subscriber-level access and the advisory states the attacker can exploit it from there. The plugin is fixed in version 2.8.194, and the advisory says the flaw exists in versions before 2.8.194. The advisory does not state any workaround or mitigation, and it gives no detection guidance or exploitation-in-the-wild information. The rest of the advisory text lists unrelated plugin vulnerabilities from other vendors, which are not part of this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2f539d43-6f95-…4f-b399-21697145591e Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	High	7.1	CVE-2026-112207	The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the... Download MonitorDownload Monitor download-monitor	NVD	Oct 24 06:16 UTC
CVE-2026-112207The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the... Executive summary The Download Monitor WordPress plugin is affected by a cross-site scripting flaw that the advisory says is high severity, with a CVSS score of 7.1 listed. The vendor's recommended action is to update the plugin to version 5.3.4, which the advisory identifies as the fixed version. Technical summary The flaw is a cross-site scripting (XSS, CWE-79) issue in which the plugin does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the content. The advisory does not describe the exact attack vector or required user interaction beyond the clicked link, and it does not state the affected version range beyond 'before 5.3.4'. The fixed version is 5.3.4. The advisory does not state any workaround, and it gives no detection guidance or information on whether the flaw is being exploited in the wild. The CVSS score is listed as 7.1 (high), but the vector string is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/03d5e83b-3119-…62-b1be-8c6fe53f9963 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Download Monitor Download Monitor download-monitor NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Critical	9.8	CVE-2026-110956	The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a... asVereinbaseasVereinbase	NVD	Oct 24 06:16 UTC
CVE-2026-110956The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a... Executive summary A WordPress plugin called asVereinbase, used on WordPress sites, has an authentication bypass flaw that lets attackers log in as users without a valid password or second factor. The advisory rates it critical with a CVSS score of 9.8 and says the fix is version 1.1.8. Technical summary The flaw is classified as an authentication bypass (CWE-287, OWASP A2 Broken Authentication): the plugin does not require a valid password or genuine second factor before authenticating a user and treats an empty stored value as a match. The advisory describes the attack vector and preconditions only partially; the text is truncated and does not state them explicitly. Affected versions are stated as before 1.1.8, and the fixed version is 1.1.8. No workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. The advisory lists a CVSS score of 9.8 (critical) and a WPVDB ID but gives no further exploitation details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/95501052-9f20-…91-9171-184cd2e4a445 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects asVereinbase asVereinbase NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.5	CVE-2026-107907	The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce... MAS VideosMAS Videos	NVD	Oct 24 06:16 UTC
CVE-2026-107907The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce... Executive summary The MAS Videos WordPress plugin, through version 1.3.4, lets people without permission delete videos and playlists from the front end of a website. The advisory rates the issue as medium severity with a CVSS score of 6.5. No fixed version or vendor recommendation is stated in the advisory. Technical summary The flaw is a missing authorization check (CWE-862, OWASP A5 Broken Access Control) in the MAS Videos WordPress plugin through 1.3.4. The plugin does not check capability or ownership when handling front-end video and playlist deletion requests, and the advisory text is truncated after mentioning a nonce, so the nonce requirement and exact preconditions are not fully stated. The advisory lists the CVSS score as 6.5 (medium). It states no known fix, so no fixed version is given. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/00de2695-275a-…1e-bd64-9a8c54235c23 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affects MAS Videos MAS Videos NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.4	CVE-2026-107887	The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child ,... Advanced Twenty SeventeenAdvanced Twenty Seventeen advanced-twenty-seventeen	NVD	Oct 24 06:16 UTC
CVE-2026-107887The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child ,... Executive summary The Advanced Twenty Seventeen WordPress plugin is affected by a missing authorization flaw that lets unauthorized users trigger an action that creates and activates a bundled child theme. The advisory rates it medium severity with a CVSS score of 5.4. No fix is listed as known, so the advisory does not state a remediation path. Technical summary The flaw is classified as CWE-862 (missing authorization) and as broken access control, because the plugin performs no capability or nonce check on the action that creates and activates its bundled child theme. The advisory does not state the attack preconditions beyond the missing check, though the classification type is listed as no authorisation. The advisory says the affected product is advanced-twenty-seventeen through version 1.3.1, and it lists no known fix. No workaround, detection guidance, or evidence of exploitation in the wild is stated. The CVSS 5.4 (medium) score and the CVE were published on 2026-10-21 per the timeline. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/e252c7ee-368d-…fb-a964-06804747c162 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects Advanced Twenty Seventeen Advanced Twenty Seventeen advanced-twenty-seventeen NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-105199	The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any... Pixel Tag Manager for WooCommercePixel Tag Manager for WooCommerce pixel-manager-for-woocommerce	NVD	Oct 24 06:16 UTC
CVE-2026-105199The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any... Executive summary The Pixel Tag Manager for WooCommerce WordPress plugin, versions before 2.2.3, contains a flaw that lets people without proper permission use one of its AJAX actions. The advisory classifies the issue as cross-site scripting with a CVSS score of 6.8 (medium), and the fix is version 2.2.3. Technical summary The advisory classifies the flaw as cross-site scripting (CWE-79) caused by a missing capability check in one AJAX action, which exposes the nonce that protects it to any authenticated or unauthenticated user as the advisory describes it. The advisory states the affected plugin is pixel-manager-for-woocommerce, fixed in version 2.2.3, and rates it 6.8 (medium). The advisory text does not state specific affected version ranges beyond 'before 2.2.3', the exact attack vector details beyond the summary, any workaround, or whether exploitation has been observed. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/69d7c59c-77d1-…2d-8ad7-6066dad59013 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects Pixel Tag Manager for WooCommerce Pixel Tag Manager for WooCommerce pixel-manager-for-woocommerce NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	High	7.1	CVE-2026-115807	The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all... Cozmoslabs, User Profile Builder, WordPressCozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, User Profile Builder, WordPress	NVD	Oct 24 05:17 UTC
CVE-2026-115807The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all... Executive summary The User Profile Builder plugin for WordPress contains a flaw that lets users with Author-level access and above create new accounts with higher-privilege roles such as Editor. The advisory describes this as a limited privilege escalation affecting all versions up to and including 4.0.3. The advisory does not state a severity rating or a vendor fix recommendation. Technical summary The flaw is a privilege escalation caused by missing server-side authorization: the Gutenberg Register block passes an attacker-controlled Assigned Role attribute into the [wppb-register] shortcode. The role guard only downgrades roles holding manage_options or remove_users, so roles such as Editor are not restricted. Exploitation requires an authenticated attacker with Author-level access or higher. Affected versions are stated as all versions up to and including 4.0.3, and a fixed version is not stated. A CVSS score, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects Cozmoslabs User Profile Builder WordPress Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor User Profile Builder WordPress NIST National Vulnerability DatabasePublished Oct 24, 2026 05:17 UTC Read the advisory
	Critical	9.8	CVE-2026-115806	The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted... Codexonics, Prime Mover, FreemiusCodexonics Prime Mover – Backup and Migration, Prime Mover – Backup and Migration, Freemius	NVD	Oct 24 05:17 UTC
CVE-2026-115806The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted... Executive summary The Prime Mover Backup and Migration plugin for WordPress has a flaw that lets an unauthenticated attacker plant malicious data through the comment form, which can be triggered when an administrator runs a routine export or restore. The advisory describes this as a PHP Object Injection issue that can enable serious compromise of the site. The advisory text provided does not state a fixed version or the vendor's specific recommendations. Technical summary The flaw is PHP Object Injection caused by unsafe deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker stores a base64-encoded serialized object in wp_comments.comment_content through wp-comments-post.php, and it is later decoded and passed to unserialize() without allowed_classes restriction when an administrator performs an export or restore. The advisory states a POP chain exists in the bundled Freemius library, so no additional plugin is required. All versions up to and including 2.2.1 are described as vulnerable. A fixed version, workaround, CVSS score, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Codexonics Prime Mover Freemius Codexonics Prime Mover – Backup and Migration Prime Mover – Backup and Migration Freemius NIST National Vulnerability DatabasePublished Oct 24, 2026 05:17 UTC Read the advisory
	High	7.6	CVE-2026-115929	MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store MongoDB, Inc., electronelectron, MongoDB, Inc. MongoDB Compass	NVD	Oct 24 01:17 UTC
CVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store Executive summary The advisory concerns MongoDB Compass, a desktop tool for MongoDB, whose TLS root certificate store comes from the bundled Electron runtime. The release notes say the issue was addressed by updating Electron, and the advisory does not state how severe the flaw is. The recommended action in the text is to use MongoDB Compass v1.53.1, which includes the updated Electron. Technical summary The advisory describes the flaw as a problem in Electron's own TLS root certificate store, which MongoDB Compass relies on. The vulnerability class, CVSS score, and attack vector are not stated. The fix is an Electron update included in MongoDB Compass 1.53.1, with the Electron v44.9.1 release notes cited as the reference for CVE-2026-115929. The affected Compass versions before 1.53.1 are not explicitly stated, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb-js/compass/releases/tag/v1.53.1 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects MongoDB, Inc.electron electron MongoDB, Inc. MongoDB Compass NIST National Vulnerability DatabasePublished Oct 24, 2026 01:17 UTC Read the advisory
	Unknown	n/a	DSA-6583-1	libheif security update DebianDebian Linux, Debian libheif	Debian Security Advisories	Oct 24
DSA-6583-1libheif security update Executive summary Debian has released a security update for libheif, a library used to read and write HEIF and AVIF images. The advisory says that processing specially crafted images could cause denial of service or disclosure of process memory, and it recommends upgrading libheif packages. Technical summary The advisory describes multiple security issues in libheif, including denial of service through excessive resource consumption or crashes and disclosure of process memory when processing crafted images. It also addresses a use-after-free and double-free in timestamp handling during image encoding, including transcoding of crafted images. For the stable distribution (trixie), the fixed version is stated as 1.23.6-2~deb13u1. The advisory does not state CVE identifiers, CVSS scores, attack vector details beyond processing crafted images, or workarounds. Detection guidance is not stated, and the advisory refers readers to the Debian security tracker for detailed status. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00499.html Score No CVSS score published. Affects Debian Debian Linux Debian libheif Debian Security TeamPublished Oct 24, 2026 Read the advisory
	Critical	9.9	CVE-2026-115931	Postiz lets a signed-in user ask the backend to run a function on one of their connected channels GitroomHQGitroomHQ postiz-app	NVD	Oct 23 23:17 UTC
CVE-2026-115931Postiz lets a signed-in user ask the backend to run a function on one of their connected channels Executive summary A flaw in the Postiz social media scheduling application, published by GitroomHQ, lets any signed-in user read files and environment secrets from the server and crash the backend. The advisory rates it Critical with a CVSS v3.1 score of 9.9, and says registration must be closed to reduce exposure, but this does not fix the issue. The vendor's recommended fix is to upgrade to version 2.25.2. Technical summary The backend does not restrict which internal helper functions a signed-in user can invoke through the channel-function interface, classified as CWE-470 and CWE-73. A user who connects a channel whose stored token is a file path can make the backend return any file it can read, including its environment, which exposes the JWT signing secret, database and Redis connection strings, and provider credentials. A separate request terminates the backend process and can be repeated after each restart. The advisory states affected versions as 2.23.0 and later, with the fix in 2.25.2, and references commit 9383f5b as the patch. Self-registration is open by default, and setting DISABLE_REGISTRATION=true is given as a partial mitigation only. Detection guidance and exploitation in the wild are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gadvisory.org/advisories/PSA-2026-JNXM56 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects GitroomHQ GitroomHQ postiz-app NIST National Vulnerability DatabasePublished Oct 23, 2026 23:17 UTC Read the advisory
	Critical	n/a	cisco-sa-php-october26-Jj384Daq	Vulnerabilities in PHP Affecting Cisco Products: October 2026 Cisco, PHPPHP, Cisco Duo Access Gateway, Cisco Ultra-Reliable Wireless Backhaul (URWB), Cisco Expressway Series, Cisco Expressway Select Series	Cisco PSIRT	Oct 23 22:39 UTC
cisco-sa-php-october26-Jj384DaqCVE-2026-109618CVE-2026-109619Vulnerabilities in PHP Affecting Cisco Products: October 2026 Executive summary Cisco published an advisory covering two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can lead to remote code execution. The advisory names a small set of Cisco products as affected, including Ultra-Reliable Wireless Backhaul, Expressway, and Duo Access Gateway, while many other Cisco products are listed as not affected or still under investigation. Cisco recommends applying the fixed software releases in the associated bug IDs and notes that workarounds exist for some products. Technical summary The flaws are remote code execution issues in PHP: CVE-2026-109618 is described as RCE via OOM corruption and CVE-2026-109619 as RCE via stale global state. The advisory does not state the network attack vector or other exploit preconditions for the core PHP flaws, but the Duo Access Gateway footnote says the attacker must be authenticated as an administrator for that product, with a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H and a score of 6.6. Affected and fixed releases listed are Ultra-Reliable Wireless Backhaul (URWB) with fixed release 27.1.1 (Feb 2027) under bug CSCwx37073, Expressway Series and Expressway Select Series with fixed release 15.5.21 (TBD) under bug CSCwx37062, and Duo Access Gateway with fixed release 3.2.0. A workaround is stated for URWB, with details in its bug ID, and workarounds for other products are referenced to bug IDs. The advisory lists Snort rules 67359 and 67360 as action links, but it does not give further detection guidance. Cisco states it is aware of a public announcement but not of any malicious use, and it does not state a base CVSS score for the core PHP flaws. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…p-october26-Jj384Daq Score No CVSS score published. Affects Cisco PHP PHP Cisco Duo Access Gateway Cisco Ultra-Reliable Wireless Backhaul (URWB)Cisco Expressway Series Cisco Expressway Select Series Cisco Product Security Incident Response TeamPublished Oct 23, 2026 22:39 UTC Read the advisory
	High	8.7	CVE-2026-115938	Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template Craft CMSCraft CMS cms, Craft CMS	NVD	Oct 23 22:16 UTC
CVE-2026-115938Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template Executive summary The advisory says that Craft CMS allows any authenticated control panel user to submit an element-search condition that is evaluated as a sandboxed Twig object template. The provided text is mostly repository page content and does not state a severity rating or a vendor-recommended fix. Defenders should check the Craft CMS security advisory and update guidance from the vendor. Technical summary The flaw is described as an injection issue in which an element selector in an element-search condition is evaluated as a sandboxed Twig object template. The attacker must be an authenticated control panel user. The advisory text does not state affected version numbers, fixed versions, a CVSS score, workarounds, exploitation status, or detection guidance. The remainder of the text is GitHub repository navigation and project description, which contains no further vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/craftcms/cms Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Craft CMS Craft CMS cms Craft CMS NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	8.7	CVE-2026-115937	The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which... Craft CMS, MollieCraft CMS commerce-mollie, Mollie for Craft Commerce	NVD	Oct 23 22:16 UTC
CVE-2026-115937The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which... Executive summary The advisory describes a flaw in the Mollie webhook endpoint of the Mollie for Craft Commerce plugin, where two attacker-controlled parameters are not checked to belong together. The advisory text provided is truncated and does not state how serious the flaw is or what fix the vendor recommends. Technical summary The flaw is described as a failure to verify that the commerceTransactionHash and a second independent parameter belong together on the Mollie webhook endpoint, which suggests an authorization or input validation weakness, but the vulnerability class is not explicitly named in the provided text. The attack vector and preconditions are not stated in full because the description is cut off. Affected versions are not stated, though the README mentions Mollie 4.1.x and 4.2.x compatibility with Craft 4 and 5, and no fixed version is stated. No workaround, detection guidance, CVSS score, or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/craftcms/commerce-mollie Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Craft CMS Mollie Craft CMS commerce-mollie Mollie for Craft Commerce NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	8.7	CVE-2026-115935	The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place... Craft CMSCraft CMS cms, Craft CMS	NVD	Oct 23 22:16 UTC
CVE-2026-115935The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place... Executive summary The advisory says that a Craft CMS action called app/process-api-response-headers accepts fake API response headers from any authenticated control panel user, including non-admin users who only have accessCp permission. The text provided does not state a severity rating, a fixed version, or a vendor recommendation. Defenders should check the official Craft CMS security notice for those details. Technical summary The flaw is described as improper acceptance of attacker-supplied API response headers in the app/process-api-response-headers action, which suggests an input validation weakness. The attacker needs only an authenticated control panel account with the accessCp permission and no admin rights. The advisory text is truncated and does not state affected version numbers, fixed versions, CVSS score, workarounds, exploitation status, or detection guidance. Those items are not stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/craftcms/cms Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Craft CMS Craft CMS cms Craft CMS NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Low	2.1	CVE-2026-115897	Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions yahoo, Serialize JavaScriptyahoo serialize-javascript, Serialize JavaScript	NVD	Oct 23 22:16 UTC
CVE-2026-115897Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions Executive summary The advisory describes a fix in the Serialize JavaScript library, which serializes JavaScript values including regular expressions and functions. The change addresses a case where a function body ending in a script close tag could be left unescaped, which could allow a closing script tag to be formed in output. The advisory does not state a severity rating, and it does not state a specific fixed version. Technical summary The flaw concerns incomplete escaping of script close tags in serialized function bodies, which is a script-injection class issue in serialized output. The patch changes the escaping regular expression so that a bare "</script" at the very end of a function body is also neutralized, because the newline added by the space option could otherwise complete the tag in the surrounding output. The advisory includes unit tests for these cases. The advisory does not state the attack vector in detail, the preconditions beyond the use of the space option, affected version ranges, fixed version numbers, CVSS score, or any workaround. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/yahoo/serialize-javascript/c…db3e70d1a079de108a61 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects yahoo Serialize JavaScript yahoo serialize-javascript Serialize JavaScript NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	8.8	CVE-2026-115895	Happy DOM is a JavaScript implementation of a web browser without its graphical user interface capricorn86, Happy DOMcapricorn86 happy-dom, Happy DOM	NVD	Oct 23 22:16 UTC
CVE-2026-115895Happy DOM is a JavaScript implementation of a web browser without its graphical user interface Executive summary The advisory covers a fix in Happy DOM, a JavaScript browser implementation, that changes how module import aliases are handled so they are not run as executable code. The advisory text provided is a code diff and does not state a severity rating or explicitly describe an exploit impact. Vendor recommendations beyond the code change are not stated. Technical summary The diff changes ECMAScriptModuleCompiler.ts so that import alias names are validated against a Unicode-aware identifier pattern and property names are emitted through JSON.stringify rather than raw string interpolation, which the added test describes as preventing unsanitized import aliases from being interpolated as executable code. A test named for this case checks that a marker global is not set after execution. The advisory does not state a CVE description, vulnerability class label, attack vector, preconditions, affected versions, fixed versions, CVSS score, workarounds, or detection guidance. The remaining diff mostly adds public suffix list entries and CSS property mappings, which are not described as security fixes. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/capricorn86/happy-dom/commit…91f7b4e4f46d6cccbe13 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects capricorn86 Happy DOM capricorn86 happy-dom Happy DOM NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Critical	9.9	CVE-2026-115893	Wasmtime is a runtime for WebAssembly bytecodealliancebytecodealliance wasmtime	NVD	Oct 23 22:16 UTC
CVE-2026-115893Wasmtime is a runtime for WebAssembly Executive summary The advisory describes a set of fixes in Wasmtime, a WebAssembly runtime, released as version 48.0.7. One listed fix covers a flaw where the Cranelift backend on aarch64 can jump to an incorrect target on a large WebAssembly br_table instruction, and the other items cover wasi-http header and body handling and a component model stream panic. The advisory does not state a severity rating for these issues, and the only recommended action it gives is to use the fixed release, with no other mitigation stated. Technical summary The aarch64 br_table issue is a control-flow flaw in the Cranelift code generator, where the jump table sequence could branch to an incorrect target on a large br_table instruction; the change replaces the conditional branch to the default target with a clamped index and an extra default entry in the jump table, and the diff notes this also acts as a Spectre mitigation. The advisory's attack vector, preconditions, and exploitation status are not stated. The fixed version is stated as 48.0.7 (released 2026-10-19), and the affected version range is not stated. No workaround and no detection guidance are stated, and no CVSS score is given. Other listed items are wasi-http guest-controlled content lengths and trailers, and a panic when lowering a host-created component model stream. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Bytecode Alliance Wasmtime Dropped extracted product not named in the source: Bytecode Alliance Cranelift Summarized from github.com/bytecodealliance/wasmtime/co…8c246937751a0bac5abd Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects bytecodealliance bytecodealliance wasmtime NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	5.7	CVE-2026-115892	Wasmtime is a runtime for WebAssembly bytecodealliancebytecodealliance wasmtime	NVD	Oct 23 22:16 UTC
CVE-2026-115892Wasmtime is a runtime for WebAssembly Executive summary The advisory is a Wasmtime release note for version 48.0.7 that lists several fixes, including one for a flaw where the Cranelift backend on aarch64 can jump to an incorrect target on a large WebAssembly br_table instruction. The advisory does not state how severe the flaw is, and it does not give a CVSS score. The release note points to the fixed release, and the vendor's recommendation is to update to the newer release. Technical summary The aarch64 flaw is a code generation issue in the Cranelift backend affecting large Wasm br_table instructions, where the emitted jump table sequence could branch to an incorrect target. The advisory's diff replaces the conditional branch to the default target with a clamp of the index into an extra default jump table entry, and it also mentions Spectre mitigation. Affected versions for this specific item are not stated explicitly, though the release notes are for 48.0.7, released 2026-10-19 according to the text. Workarounds are not stated, and no detection guidance is given. The advisory does not state whether the issue has been exploited in the wild, and it does not give a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Bytecode Alliance Wasmtime Dropped extracted product not named in the source: Bytecode Alliance Cranelift Summarized from github.com/bytecodealliance/wasmtime/co…8c246937751a0bac5abd Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required High User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects bytecodealliance bytecodealliance wasmtime NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Critical	9.9	CVE-2026-115889	Wasmtime is a runtime for WebAssembly bytecodealliance, Wasmtimebytecodealliance wasmtime, Wasmtime	NVD	Oct 23 22:16 UTC
CVE-2026-115889Wasmtime is a runtime for WebAssembly Executive summary The advisory is a diff of a Wasmtime source file, a WebAssembly runtime, changing how internal value data is packed in the Cranelift code generator. The text does not describe a security impact, severity rating, or recommended action from the vendor, and it does not name affected or fixed versions. Technical summary The diff changes the ValueDataPacked layout in cranelift/codegen/src/ir/dfg.rs from a packed u64 with 24-bit x and y fields to a repr(Rust, packed) struct with 32-bit x and y fields and a 16-bit flags_and_type field, and removes the encode_narrow_field and decode_narrow_field helpers. The advisory text does not state a vulnerability class, attack vector, or preconditions, and it does not state affected versions, fixed versions, workarounds, exploitation status, or a CVSS score. No detection guidance is given. The text is a code diff only, so the security impact is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/bytecodealliance/wasmtime/co…fa75cd9d03f4a438dae0 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects bytecodealliance Wasmtime bytecodealliance wasmtime Wasmtime NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	7.5	CVE-2026-115887	GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas graphql-hive, GraphQL Scalarsgraphql-hive graphql-scalars, GraphQL Scalars	NVD	Oct 23 22:16 UTC
CVE-2026-115887GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas Executive summary This advisory describes a performance fix in the GraphQL Scalars library, a project that provides custom GraphQL scalar types. The change addresses a regular expression in the PhoneNumber scalar that could take excessive time to process certain inputs, which is a denial-of-service style risk. The advisory does not state a severity rating, and the recommended action it gives is to use the patched code, which the changeset describes as a patch-level fix. Technical summary The fix replaces the PhoneNumber scalar regular expression in src/scalars/PhoneNumber.ts with a pattern that the change describes as matching in linear time, indicating a regular expression denial-of-service (ReDoS) issue. The advisory states the new pattern accepts exactly the same values as before. The attack vector, preconditions, and CVSS score are not stated, and no affected version range or fixed version number is stated in the text provided. No workarounds are stated. The added tests send a 31-character input of repeated digits ending in a letter and check that serialize, parseValue, and parseLiteral reject it in under 1000 milliseconds; no other detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/graphql-hive/graphql-scalars…00c00144245c74361701 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects graphql-hive GraphQL Scalars graphql-hive graphql-scalars GraphQL Scalars NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	6.5	CVE-2026-115886	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models mlflowmlflow	NVD	Oct 23 22:16 UTC
CVE-2026-115886MLflow is an open source AI engineering platform for agents, large language models, and machine learning models Executive summary The advisory is a code diff for MLflow, an open source AI engineering platform, that adds server-side checks on serialized scorer payloads. It describes the change as closing a gap where scorer data the server could execute or use to steer outbound requests was not validated when sent directly to the REST API. The advisory does not state a severity rating, and it does not state a specific vendor recommendation beyond the code change itself. Technical summary The diff adds a helper, _validate_serialized_scorer_payload, that rejects decorator scorers carrying a call_source field, since that field is executed via exec() during deserialization, and applies this check to request payloads and to scorers fetched from the store. It also adds _validate_third_party_scorer_data, which rejects non-object kwargs and gateway destination keys such as api_base at any nesting depth, because these could direct the judge's LLM client to an attacker-chosen host. The advisory does not state the vulnerability class by name, the CVSS score, the attack preconditions beyond direct REST API access, affected version ranges, fixed version numbers, workarounds, or exploitation status, and these are not stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mlflow/mlflow/commit/bac30b4…d4db07ae60ab3838803f Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects mlflow mlflow NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	4.1	CVE-2026-115885	The LangGraph CLI is the official command-line interface for LangGraph langchain-ai, @langchainlangchain-ai langgraph, @langchain LangGraph CLI	NVD	Oct 23 22:16 UTC
CVE-2026-115885The LangGraph CLI is the official command-line interface for LangGraph Executive summary The advisory describes changes to the LangGraph CLI, the official command-line interface for LangGraph, shown as code diffs in a repository. The advisory text does not state how serious the issue is, what the vendor recommends, or which versions are affected. Technical summary The advisory is a copied repository diff page for the LangGraph CLI, covering changes to deploy.py, exec.py, host_backend.py, and image_reference.py, and does not name a vulnerability class in plain terms. The changes add endpoint resolution logic that derives control plane and dashboard URLs from a host URL or LangSmith endpoint, and they let callers pass a custom httpx transport. Attack vector and preconditions are not stated. Affected and fixed versions are not stated. Workarounds are not stated. Exploitation status and CVSS score are not stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/langchain-ai/langgraph/commi…3a0e9133a07ffd6a553c Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required Low User interaction Passive CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects langchain-ai @langchain langchain-ai langgraph @langchain LangGraph CLI NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115883	LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents langchain-ailangchain-ai langgraph, langchain-ai langgraph-checkpoint-postgres, langchain-ai langgraph-checkpoint-sqlite	NVD	Oct 23 22:16 UTC
CVE-2026-115883LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents Executive summary The advisory describes a change to LangGraph checkpoint savers for Postgres and SQLite, which add validation of namespace labels in store operations. The advisory text does not state a severity rating, and it does not describe the change as a fix for a named exploit or give a vendor recommendation. Impact on users is not stated. Technical summary The advisory shows a code change that calls a new validate_op_namespace check on each store operation in the Postgres and SQLite store base modules, and adds tests that reject namespace labels containing dots, empty strings, or non-string values. The tests suggest the concern is that dot-joined namespaces such as ("foo.bar",) could reach the same stored location as ("foo", "bar"), but the advisory does not explicitly state a vulnerability class, CVSS score, attack vector, or preconditions. Affected versions are not stated, fixed versions are not stated, and workarounds are not stated. Exploitation status is not stated, and no detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: LangGraph LangGraph checkpoint-postgres Dropped extracted product not named in the source: LangGraph LangGraph checkpoint-sqlite Summarized from github.com/langchain-ai/langgraph/commi…2cebf8825e911b493ab1 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects langchain-ai langchain-ai langgraph langchain-ai langgraph-checkpoint-postgres langchain-ai langgraph-checkpoint-sqlite NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Low	1.9	CVE-2026-115801	A security flaw has been discovered in Kakao khaiii up to 0.4 KakaoKakao khaiii	NVD	Oct 23 22:16 UTC
CVE-2026-115801A security flaw has been discovered in Kakao khaiii up to 0.4 Executive summary A security flaw has been reported in Kakao khaiii, a Korean morphological analyzer, in versions up to 0.4. The advisory text provided is mostly a copy of the project's GitHub readme and does not describe the flaw, its severity, or a vendor fix. Technical summary The advisory states that a security flaw exists in Kakao khaiii up to 0.4 but gives no vulnerability class, attack vector, or preconditions. Affected and fixed versions beyond the phrase 'up to 0.4' are not stated. No CVSS score, workaround, exploitation status, or detection guidance is stated. The remaining text is repository and project documentation, not vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/kakao/khaiii Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Kakao Kakao khaiii NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Low	3.1	CVE-2026-83813	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-83813Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a fix in the Twisted framework's DNS code, in which DNS responses were not checked against the address that sent the original query. The advisory does not state a severity rating for this issue. The text provided contains only a code diff, so the vendor's recommended action beyond the code change is not stated. Technical summary The change touches the DNSDatagramProtocol class in src/twisted/names/dns.py and adds a per-message-ID record of the query's destination address. Incoming datagrams whose message ID matches a live query are now dropped unless the source address matches the stored address. This suggests the earlier weakness was a missing source-address check on DNS responses, which would be a spoofing or response-injection class issue, but the advisory does not explicitly name the vulnerability class. Attack vector, preconditions, and the affected version range are not stated. The fixed release version is not stated. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/b53e1…1c74cf9e48373b5879ac Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	5.3	CVE-2026-75525	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-75525OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary An unauthenticated remote attacker can insert an encryption key of their own choosing into the staff key directory of OpenReception's appointment booking software, so future appointments in the affected tenant get encrypted to that key as well. The advisory rates this Moderate with a CVSS 3.1 score of 5.3 and says the flaw affects versions up to and including 2.1.0. The advisory states that no patched version is available, and it does not state a workaround. Technical summary The flaw is an incorrect authorization issue (CWE-863) in the POST /api/tenants/{id}/staff/{staffId}/crypto handler, which accepts a registration write when the webauthn-registration-email cookie matches the request-body email. The cookie can be obtained without authentication by calling POST /api/auth/challenge with any email, including one that does not exist. The write is not bound to the target staff member's stored email, the tenant membership, or a signed registration session. The advisory lists affected versions as <= 2.1.0 and patched versions as None. It states that the attacker cannot retrieve ciphertext on its own because retrieval requires a valid staff session, and that the issue can be exploited only for users without an active key. No workaround is stated, and no specific detection guidance is stated. The advisory recommends requiring the signed registration-bootstrap session and binding the write to the target staff email and tenant. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…/GHSA-qc72-9fg9-h66h Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	5.4	CVE-2026-75524	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software	NVD	Oct 23 21:17 UTC
CVE-2026-75524OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary The advisory describes a fix in OpenReception's appointment booking software, which provides an end-to-end encrypted appointment booking platform. It shows a code change that adds row locking and transactions to prevent double-booking of agents when appointments are created at the same time, but it does not state a severity rating or a CVE-specific impact in the text provided. Technical summary The advisory is a copied code diff from a commit in the appointment service, not a formal vulnerability description. The change moves the agent availability check into a database transaction and adds a SELECT ... FOR UPDATE lock on the agent row, which the code comment says is meant to avoid race conditions between concurrent appointment creations. Attack vector, preconditions, CVSS score, affected versions, fixed versions, workarounds, and exploitation status are not stated in the advisory. Vulnerability class is implied to be a race condition (likely double-booking), but the advisory does not name it explicitly. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…897dc1f494ace2f0e452 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects open-reception open-reception appointment-booking-software NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.5	CVE-2026-65825	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-65825OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary A flaw in OpenReception's appointment booking software lets one tenant disable the PIN brute-force protection that applies to a returning client in another tenant, so a six-digit booking PIN could be guessed online. The advisory rates it High with a CVSS score of 7.5 and states that no patched version is available (patched versions: None). The advisory does not state a vendor-recommended fix beyond the changes the researcher suggests. Technical summary This is an improper restriction of excessive authentication attempts (CWE-307) caused by inconsistent tenant scoping in the challenge_throttle table. The throttle row is keyed on the tenant-independent emailHash, but reads filter by tenant_id while writes never update it, so the first tenant to record a failure owns the row and other tenants see no throttle. Exploitation is over the network with no privileges or user interaction, but requires two tenants on one instance and knowledge of the victim's email. The advisory lists affected versions as <= 2.1.0 and patched versions as None. It states no workaround from the vendor, though the researcher recommends a consistent throttle key, not trusting x-forwarded-for for rate limiting, and raising PIN entropy. The advisory does not state whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…/GHSA-v4q4-xmqf-gmq8 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.4	CVE-2026-65824	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-65824OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary The advisory describes a fix in the OpenReception appointment booking software, where an invitation token could be reused to sign up again. The advisory shows a code change that stops used invitations from being accepted and marks invites as used sooner, and it does not give a severity rating. The advisory does not state any vendor recommendation beyond the code change. Technical summary The flaw appears to be reuse of an invitation token in the user registration flow in src/lib/server/services/user-service.ts. The patch adds a check that the invite has not been used before accepting it, and moves the call that marks the invite as used so it runs regardless of the user confirmation state. The advisory does not state the vulnerability class, CVE-specific impact, attack preconditions, affected versions, fixed versions, workarounds, CVSS score, or detection guidance. The advisory does not state whether the issue has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…c0a6deb9267bfec03622 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	8.3	CVE-2026-58202	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-58202OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary The advisory covers OpenReception, an end-to-end encrypted appointment booking platform. The text provided is a GitHub release page for v2.0.0 that mentions a fix for a security advisory (GHSA-w5g9-g2p4-2g4m) but does not describe the flaw's impact or severity. The advisory does not state how serious the issue is, and it does not say whether it is being exploited. Technical summary The release notes say the fix for GHSA-w5g9-g2p4-2g4m, reported by Volcore, is included in v2.0.0, but they do not name the vulnerability class, attack vector, or preconditions. The release also makes a breaking change by requiring a new MANAGEMENT_DOMAIN environment variable, which the notes say ensures security for system administration. Affected versions are not stated in the text, though the release is compared against v1.1.1 in the changelog. No CVSS score, workaround, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…/releases/tag/v2.0.0 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	5.4	CVE-2026-115877	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115877Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a request-smuggling gap in the Twisted web framework's HTTP header parsing, where a header value containing a bare carriage return or line feed could hide a following header from the parser. The advisory does not state a severity rating. The fix, as shown in the diff, makes the server reject such header values with a 400 response and close the connection. Technical summary The flaw is a request-smuggling issue in twisted.web.http.HTTPChannel.headerReceived, which accepted header values containing bare CR or LF characters that a lenient proxy could interpret differently. The diff adds a check that rejects header values containing NUL, CR, or LF with a 400 Bad Request and disconnects, citing RFC 9110 section 5.5. The advisory does not state affected version ranges, fixed version numbers, workarounds, exploitation status, or a CVSS score. Detection guidance is not stated, though the added test sends bare CR and LF header values and expects a 400 response. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/1616f…a5b22ad70fab140a7eb1 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Low	1.9	CVE-2026-115800	A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2 UbiquitousLearningUbiquitousLearning mllm	NVD	Oct 23 21:17 UTC
CVE-2026-115800A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2 Executive summary The advisory says a vulnerability was identified in UbiquitousLearning mllm, a multimodal large language model inference engine, in versions up to 2.0.2. The text provided is mostly a copy of the project's GitHub repository page and does not describe the flaw, its severity, or a vendor recommendation. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It names mllm versions up to 2.0.2 as affected, but no CVSS score, fixed version, workaround, or detection guidance is stated. Exploitation in the wild is not stated. The provided text is a repository README with build, model, and tool documentation, and it contains no vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/UbiquitousLearning/mllm Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects UbiquitousLearning UbiquitousLearning mllm NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.5	CVE-2026-115778	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115778Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory covers a Twisted Telnet protocol issue where a remote peer could send a telnet subnegotiation that is never terminated, causing the server to buffer data without limit and potentially exhaust its memory. The fix caps the buffer and drops the connection when the cap is exceeded. The advisory text provided does not state a severity rating or CVSS score. Technical summary The flaw is an unbounded memory buffer (resource exhaustion) in twisted.conch.telnet.Telnet when parsing an unterminated IAC SB subnegotiation, as described in the changed code and newsfragment. The fix adds a _MAX_SUBNEGOTIATION_LENGTH cap of 4096 bytes, logs a warning, and drops the connection when the cap is exceeded, with escaped IAC IAC bytes counting toward the cap. The advisory does not state affected version ranges or a fixed release version, and does not state a CVSS score, exploitation status, or workaround. No detection guidance beyond the logged warning text is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/073ba…1abc5ae76d46eff1b529 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.5	CVE-2026-115776	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115776Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a fix in the Twisted Python networking framework's IRC protocol component, where a remote peer could exhaust server memory by sending data without a line delimiter. The advisory does not state a severity rating or a CVSS score. The fix adds a maximum line length that drops the connection when exceeded, and the advisory points to upgrading to the patched release. Technical summary The weakness is unbounded buffer growth in twisted.words.protocols.irc.IRC, where data without a line delimiter accumulates in memory, which is a resource exhaustion issue. A remote peer that can connect to the IRC protocol and send data without a newline can trigger it, and the advisory does not state other preconditions. The fix adds a MAX_LENGTH class attribute with a default of 16384 and calls lineLengthExceeded, which drops the connection by default. The advisory does not state affected or fixed version numbers, does not give a workaround, and does not provide detection guidance. The advisory text is a diff and does not state these items explicitly. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/01f8c…380b2ea939fa6bdbab30 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	8.7	CVE-2026-115775	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115775Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a change to the Twisted Python networking framework's XML stream parser in twisted.words, used for XMPP messaging, which previously let a peer exhaust server memory by sending an unbounded stanza. The fix adds per-stanza size and element-count limits. The advisory does not state a severity rating or CVSS score, and it does not give affected or fixed version numbers. Technical summary The weakness is unbounded resource consumption (memory exhaustion) in the domish XML element streams of twisted.words.xish, which parse XMPP stanzas from a peer. The advisory's diff adds maxStanzaSize and maxElementCount limits to SuxElementStream and ExpatElementStream, raising ParserError when exceeded, with counters reset when a stanza is emitted. The attack vector is a remote peer sending a large or unbounded stanza; no authentication requirement is stated. Affected and fixed version numbers are not stated, and no workaround is stated. Exploitation status and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/88738…ad4d2c4d64039beb88b0 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	4.9	CVE-2026-115774	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115774Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a flaw in the Twisted framework's IMAP mail server component, where an authenticated client could send a crafted SEARCH command that freezes the server. The advisory does not state a severity rating or CVSS score. The fix rejects literals with a negative octet count, and the advisory gives no workaround beyond applying the code change. Technical summary The flaw is a denial-of-service condition in the parseNestedParens function of twisted.mail.imap4, where a literal with a negative octet count causes the parser to loop without terminating. The attacker must be an authenticated IMAP client sending a crafted SEARCH command. The fix adds a check that raises ValueError with the message "Illegal literal size" when the literal size is less than zero, and a unit test named test_literalNegativeSize was added. The advisory does not state affected version numbers, fixed version numbers, a CVSS score, or any workaround. Exploitation in the wild and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/3d125…97f480bb699a5e074741 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-113951	If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf AppleApple Container	NVD	Oct 23 21:17 UTC
CVE-2026-113951If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf Executive summary The apple/container project's K8s plugin can let content from an untrusted Linux container run commands on the macOS host. The advisory rates this as High severity, and the vendor's recommendation is to upgrade apple/container to version 1.5.0, which contains the fix. Technical summary The flaw is an unfiltered merge of a cluster container's kubeconfig into the host kubeconfig, which lets an attacker who can write to /etc/kubernetes/admin.conf inside the cluster container plant an exec credential plugin that kubectl runs as the macOS host user. The advisory says the trigger is a later write-config or create --node-image run, and the attacker needs prior write access to the cluster container's filesystem through a compromised workload, a hostPath mount, or a tampered node image. Affected versions are stated as less than 1.5.0, with 1.5.0 as the patched version. The advisory states no CWE, no CVSS score, and no information on exploitation in the wild. Detection guidance is given as running kubectl config view --raw to check whether any cluster-related user has a non-empty exec or auth-provider entry. Workarounds are avoiding write-config against untrusted clusters and avoiding create --node-image with untrusted node images. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/apple/container/security/adv…/GHSA-44v5-vx46-ghv6 Score No CVSS score published. Affects Apple Apple Container NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-113877	HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each... Robert RothenbergRobert Rothenberg HTTP::Headers::ActionPack	NVD	Oct 23 21:17 UTC
CVE-2026-113877HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each... Executive summary HTTP::Headers::ActionPack for Perl, before version 0.10, can be forced to use excessive CPU by a crafted Accept-Language header. The advisory says the fix changes language matching so header values are compared as plain text instead of regular expressions. The advisory does not state a severity rating, and the fix is in the code change shown. Technical summary The flaw is classed as CPU exhaustion caused by treating Accept-Language range values as unescaped regular expressions, which is a regular expression denial-of-service issue. The advisory states that versions before 0.10 are affected and that the attacker can submit crafted Accept-Language headers, with no authentication described in the text. The patch replaces the regex match in _language_match with a case-insensitive exact, wildcard, or prefix comparison using substr, and adds a timing test. The fixed version is stated as 0.10 in the affected-version line, and the Changes entry is under an unreleased heading, so the released version number is not otherwise stated. No workaround is stated, no CVSS score is stated, and no detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/robrwo/perl-HTTP-Headers-Act…2750e0f0f4bec9.patch Score No CVSS score published. Affects Robert Rothenberg Robert Rothenberg HTTP::Headers::ActionPack NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-79982	The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79982The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer... Executive summary A flaw in the Bluetooth HCI USB transport class of the new USB device stack can let a nearby attacker overflow a memory buffer on affected devices. The advisory says it can cause a remote crash, and on production builds without memory protection it can potentially lead to arbitrary code execution. The advisory does not state a fixed version, and the fix described is a separate, larger buffer pool for the controller-to-host direction. Technical summary This is a buffer overflow (CWE class not stated) in subsys/usb/device_next/class/bt_hci.c, where HCI packets are copied into fixed 64-byte USB pool slots with no length check via net_buf_add_mem(). Attack preconditions include a Bluetooth-range attacker, with a connected peer using Data Length Extension or broadcasting extended advertising data, and the advisory notes the overflow is also reached on every host initialization in the stock configuration through a 70-byte Read Supported Commands event. With CONFIG_ASSERT=n and CONFIG_NET_BUF_HARDENING disabled, memory corruption may occur; with assertions enabled, the device panics. The advisory describes a fix that adds a bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE). Affected and fixed version numbers are not stated, and no workaround or detection guidance is stated beyond the configuration options discussed. CVSS score and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zephyr Zephyr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Medium	6.5	CVE-2026-79981	The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() ->... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79981The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() ->... Executive summary The advisory says the DNS stub resolver in an embedded networking stack reuses one source UDP port for all queries, which lets an attacker on the same network segment or with UDP reachability to the device race forged DNS replies and make an application resolve an attacker-chosen address. The advisory describes the flaw as allowing redirection of name resolution, but it does not state a severity score. The fix randomizes the source port per query, and the advisory describes it as controlled by a configuration option that defaults to enabled. Technical summary The flaw is a weak-randomness issue in DNS query matching, where the resolver keeps a constant UDP source port for its lifetime so only the 16-bit transaction identifier varies, contrary to RFC 5452 section 9.2. The advisory says the reply source address is never checked, so forged replies need only reach the resolver's port and win a race against the legitimate server. Preconditions are UDP reachability to the device, such as the same LAN or a globally routable address, and winning the race during a query window; the advisory notes TLS certificate validation largely protects applications. Affected versions are not stated, and no fixed version is given; the fix is described as dns_randomize_source_port() with CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT defaulting to y. No workaround beyond that configuration is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Medium	5.6	CVE-2026-79980	The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random value zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79980The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random value Executive summary The DHCPv4 client in Zephyr's networking subsystem can be fooled by forged DHCP replies because its transaction identifier is predictable and reused. The advisory says an attacker on the same network, or a DHCP server the device previously joined, could redirect the device's default gateway and DNS resolvers. The advisory does not state a severity score; the vendor fix changes how the identifier is generated. Technical summary The flaw is a predictable transaction identifier (xid) in the DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c, which is treated as a counter instead of a fresh random value per transaction, so an observed xid stays valid for the device's uptime. The attack requires only that the attacker learn one xid, for example by seeing the broadcast DHCPDISCOVER, since the reply checks cover op, xid and chaddr (public MAC) and the UDP callback accepts any remote address and port. A single accepted forged reply can change the default gateway and DNS resolvers through option processing that runs before the state gate, and a forged DHCPACK or DHCPNAK can alter the lease during RENEWING or REBINDING. The advisory states the fixed version is not stated, no workaround is stated, and no detection guidance is stated; the fix draws fresh sys_rand32_get() values when transactions begin. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zephyr Project Zephyr Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.8	CVE-2026-79979	The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79979The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt... Executive summary The advisory describes a flaw in the arm64 memory management code of a system that uses memory domains and demand paging. An unprivileged user thread could keep access to a physical memory page after it was reclaimed and reused, potentially reading or changing kernel data or other threads' memory. The advisory does not state a severity score, and the fix is a code change that switches the cache invalidation instruction to one that clears all matching entries. Technical summary The root cause is that invalidate_tlb_page() issued a TLBI VAE1 operation with an operand that encoded only ASID 0, so stale non-global translations for user memory domains were not removed when a demand-paged frame was evicted. This is a stale translation (use-after-reclaim) class issue, reachable from unprivileged code in a user thread that drives memory pressure to force eviction. Preconditions are an arm64 build with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain. The fix uses TLBI VAAE1{IS}, and the advisory also stops globalize_table() from stripping EL0 permissions during paging synchronization. Affected and fixed version numbers are not stated, and no workaround is stated. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Low	3.6	CVE-2026-79978	The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79978The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len... Executive summary A flaw in the Zephyr-style ADXL345 accelerometer streaming driver can cause the driver to write sensor data past the end of a memory buffer when the buffer pool is short on space. The advisory says the result is silent corruption of other data or a crash, and it is reached only through local conditions on boards with this sensor and streaming enabled. The advisory does not state a fix or a vendor recommendation. Technical summary This is an out-of-bounds write (buffer overflow) in adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c, where the number of queued 6-byte FIFO reads is bounded by the device entry count rather than the clamped buffer length, writing up to 186 bytes past an undersized allocation. A second defect leaves data->fifo_total_bytes unreset at batch start, so a stale offset after an aborted chain can cause further out-of-bounds writes. Preconditions are an interrupt-wired ADXL345, CONFIG_ADXL345_STREAM enabled, and RTIO block pool starvation or fragmentation, which can be induced by a co-resident local workload. The advisory states there is no network, USB or radio attack path. Affected and fixed version numbers are not stated, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zephyr Project Zephyr Dropped extracted product not named in the source: Analog Devices ADXL345 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	8.2	CVE-2026-79977	The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79977The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate Executive summary The advisory says the WireGuard VPN service in subsys/net/lib/wireguard/wg.c can be made to send tunnel traffic to an address chosen by an attacker, because it accepts an unauthenticated message and updates the peer endpoint from it. A single spoofed UDP packet sent to the default port 51820 can persistently break the tunnel and let an attacker sit in its path, though the advisory states that encryption still prevents decryption or forgery of content. The advisory does not state a severity score, and it describes a fix that stops learning endpoints from unauthenticated messages. Technical summary The flaw is classified as the update of a peer endpoint from an unauthenticated message. In handle_transport_data(), a transport-data message whose 32-bit receiver index matches no session causes a new handshake to be scheduled and the datagram source address to be copied into peer->endpoint with memcpy. The listener has no remote address or port filter and defaults to UDP port 51820, so an off-path host can send a 16-byte spoofed datagram, and the vulnerable branch runs when the peer has no valid handshake or current keypair, such as at boot or after a session expires. The advisory states that the impact is loss of availability and limited confidentiality of metadata, not key compromise. Affected and fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is stated. The advisory describes the fix as keeping stale-session recovery while sending handshakes only to an endpoint learned from an authenticated message or the configured cfg_endpoint, and it notes CONFIG_WIREGUARD is marked experimental and not enabled by default. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.5	CVE-2026-19741	Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig,... zephyrproject, Zephyr, OpenThreadzephyrproject zephyr, Zephyr, OpenThread	NVD	Oct 23 20:17 UTC
CVE-2026-19741Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig,... Executive summary The advisory says Zephyr's OpenThread integration shipped a publicly known default joining credential, "J01NME", that could let an unauthenticated attacker within radio range take over commissioning of an uncommissioned device. The advisory describes the consequence as a device joining an attacker-controlled network and remaining mis-provisioned until reset. The fix removes the default and requires a per-device credential, and the advisory recommends provisioning a unique credential per device from factory data. The advisory does not state a severity score. Technical summary This is a use of a hardcoded or publicly known default credential (CONFIG_OPENTHREAD_JOINER_PSKD defaulting to "J01NME") in the Thread commissioning handshake. The attack requires an attacker within 802.15.4 radio range of an uncommissioned device, such as one that is factory-fresh, freshly reset, or had its settings erased, and that is built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y without overriding the PSKd. The attacker can run a stock commissioner with that credential, complete the DTLS-PSK handshake, and supply a malicious operational dataset. The advisory states the option is not enabled by default and no in-tree sample uses the vulnerable combination. Affected and fixed version numbers are not stated, and no CVSS score, workaround beyond overriding the PSKd, or detection guidance is stated. The fix adds a BUILD_ASSERT() requiring a 6-to-32-character PSKd when joiner autostart is enabled. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects zephyrproject Zephyr OpenThread zephyrproject zephyr Zephyr OpenThread NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Low	2.9	CVE-2026-115797	A weakness has been identified in Tenda F6 12.02.01.73 TendaTenda F6	NVD	Oct 23 20:17 UTC
CVE-2026-115797A weakness has been identified in Tenda F6 12.02.01.73 From the advisory A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tenda Tenda F6 NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Low	2.1	CVE-2026-115796	A security flaw has been discovered in Tenda F6 12.02.01.73 TendaTenda F6, Tenda F6 (N300) Wireless Router	NVD	Oct 23 20:17 UTC
CVE-2026-115796A security flaw has been discovered in Tenda F6 12.02.01.73 Executive summary A security flaw in the Tenda F6 (N300) wireless router firmware V12.02.01.73 lets an attacker who tricks a logged-in administrator into opening a malicious web page perform administrative actions on the router, such as a factory reset, reboot, or password change. The advisory rates it High with a CVSS 3.1 base score of 8.0 and says the vendor had not responded when the report was written. The advisory does not state a vendor fix or recommended update; it lists remediation steps for the vendor to implement. Technical summary The flaw is a cross-site request forgery (CWE-352) in the router's web management interface, which accepts state-changing POST requests to /goform/ endpoints without anti-CSRF tokens or SameSite cookie restrictions. The attack requires an authenticated administrator to open an attacker-controlled page while on the device's network; the advisory gives a CVSS vector of AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Affected version is stated as Firmware V12.02.01.73 (Hardware V5.0), and the latest version at disclosure is stated as V12.02.02.77, which the researchers did not test. The advisory does not state a fixed version, and it does not state any workaround beyond the vendor remediation steps (anti-CSRF tokens, SameSite cookies, re-authentication for sensitive actions, and removing the recoverable Wi-Fi password from configuration downloads). Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/0xWKZER/tenda-f6-vulnerabili…blob/main/01-csrf.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tenda Tenda F6 Tenda F6 (N300) Wireless Router NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115586	virtualenv is a tool for creating isolated virtual python environments pypa, virtualenvpypa virtualenv, virtualenv	NVD	Oct 23 20:17 UTC
CVE-2026-115586virtualenv is a tool for creating isolated virtual python environments Executive summary The advisory is a set of code changes to the virtualenv Python tool, adding CodeQL security queries and related fixes, which points to link-following and shell-quoting weaknesses in virtualenv. The advisory does not state a severity rating for a specific vulnerability, and it does not give a clear description of the impact on users. Technical summary The text shows a diff that adds CodeQL queries for possible flaws: permission changes inside shutil.rmtree error handlers (CWE-732), writes that follow a link at the destination (CWE-59), unsafe quoting in activator scripts (CWE-116), and unquoted shebangs (CWE-78). It also updates a changelog entry for issue 3466 and a threat model document. The advisory does not state affected versions, fixed versions, CVSS score, attack preconditions for a specific CVE, workarounds, or whether any of these issues is exploited in the wild. The text does not explicitly confirm that a vulnerability was fixed, so these details are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/pypa/virtualenv/commit/3598e…6b2347a8a919ac03c5f4 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required None User interaction Active CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects pypa virtualenv pypa virtualenv virtualenv NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115585	pypdf is a free and open-source pure-python PDF library py-pdfpy-pdf pypdf	NVD	Oct 23 20:17 UTC
CVE-2026-115585pypdf is a free and open-source pure-python PDF library Executive summary This advisory is a code diff for pypdf, a open-source Python PDF library, and it shows performance-related changes to how the library reads PDF files. The advisory does not state a severity rating or describe a security impact, and it does not name a fixed release. Technical summary The diff changes pypdf's object lookup and cross-reference table recovery so that a new helper, get_stream_data, reads the whole stream instead of repeating the same code, and it adds a cache check keyed on object generation and number. The added tests measure speed for repeated invalid object lookups and for large cross-reference tables, which suggests the underlying issue is excessive processing time on crafted input. The advisory does not state the vulnerability class, attack vector, preconditions, affected versions, fixed versions, workarounds, or exploitation status, and it does not describe any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/68a0e504…a21a713f3c7fbde18b4b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects py-pdf py-pdf pypdf NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115580	pypdf is a free and open-source pure-python PDF library py-pdfpy-pdf pypdf	NVD	Oct 23 20:17 UTC
CVE-2026-115580pypdf is a free and open-source pure-python PDF library Executive summary The advisory describes a flaw in pypdf, a free open-source Python library for reading PDF files. The text provided contains only a code diff and no severity rating, so the advisory does not state how serious the issue is or what the vendor recommends. Technical summary The diff changes how pypdf reads the size declared in a standard cross-reference table, adding a check that rejects a declared size larger than the stream length divided by 20 and raises LimitReachedError. The change suggests a resource-exhaustion or malformed-input issue, but the advisory does not explicitly state the vulnerability class, attack vector, or preconditions. Affected version ranges are not stated, and no fixed version number is stated. No workaround and no exploitation status are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/a3061e34…20f5f049c53cfb1482b2 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects py-pdf py-pdf pypdf NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115572	pypdf is a free and open-source pure-python PDF library py-pdfpy-pdf pypdf	NVD	Oct 23 20:17 UTC
CVE-2026-115572pypdf is a free and open-source pure-python PDF library Executive summary This advisory shows source code changes to pypdf, a free open-source Python PDF library, that appear to address performance problems when repeatedly looking up invalid PDF objects and reading cross-reference tables. The advisory text does not state a severity rating or describe an exploitable security impact. It does not state any vendor recommendation or fixed version. Technical summary The advisory is a diff of commits to pypdf, with new tests named for speed and caching of repeated invalid object lookups and standard xref table reads. The changes add a get_stream_data helper in _utils.py, change the cache check in get_object in _reader.py, and rename a parameter in _doc_common.py. The advisory does not state a vulnerability class, CVSS score, attack vector, preconditions, affected versions, fixed versions, workarounds, or detection guidance. The tests reference earlier run times of about 25 seconds, which suggests a performance issue, but the advisory does not explicitly call it a security vulnerability. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/68a0e504…a21a713f3c7fbde18b4b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects py-pdf py-pdf pypdf NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Medium	6.8	RHSA-2026:88779	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Red Hat Enterprise Linux Server - Extended Life Cycle Support 7, Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7, Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7, Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7, Mozilla ca-certificates	Red Hat Security Advisories	Oct 23 19:53 UTC
RHSA-2026:88779CVE-2026-114406ca-certificates security update Executive summary This Red Hat advisory covers a security update for the ca-certificates package on Red Hat Enterprise Linux 7 Extended Lifecycle Support systems across x86_64, IBM z Systems, and IBM Power platforms. Red Hat rates the update as Critical and says it distrusts eMudhra intermediate CA certificates due to security concerns. Red Hat recommends applying the updated ca-certificates package. Technical summary The flaw is tracked as CVE-2026-114406 and is fixed by distrusting eMudhra intermediate CA certificates in the ca-certificates package, which contains Mozilla-selected CA certificates used for Internet PKI. The advisory does not describe the specific vulnerability class, attack vector, or preconditions for exploitation. The fixed package version is ca-certificates-2026.2.92_v9.0.319-70.3.el7_9, and the advisory lists no workarounds. No CVSS score is given in the text itself, and it is not stated whether the issue is exploited in the wild. The advisory provides no detection guidance beyond the package update and a link to the Red Hat article on applying updates. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88779 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 Mozilla ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 19:53 UTC Read the advisory
	Medium	6.8	RHSA-2026:88562	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Mozilla ca-certificates	Red Hat Security Advisories	Oct 23 19:43 UTC
RHSA-2026:88562CVE-2026-114406ca-certificates security update Executive summary This Red Hat advisory covers a critical update to the ca-certificates package on Red Hat Enterprise Linux 9.2 systems, including several Update Services and Extended Life Cycle variants. The update distrusts eMudhra intermediate Certificate Authority certificates because of security concerns, and Red Hat rates it Critical. Red Hat recommends applying the ca-certificates update described in the advisory on affected systems. Technical summary The flaw is tracked as CVE-2026-114406 and is described as a decision to distrust eMudhra intermediate CA certificates due to security concerns, so the vulnerability class is not stated beyond that. The advisory does not describe the attack vector, exploitation preconditions, or whether exploitation has occurred. The fixed package is ca-certificates-2026.2.92_v9.0.319-90.3.el9_2 for the listed RHEL 9.2 variants. The advisory does not state a CVSS score in the text provided, and it refers readers to the CVE page for it. No workaround is stated, and no detection guidance is stated beyond applying the update per the linked Red Hat article. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88562 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Mozilla ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 19:43 UTC Read the advisory
	High	8.1	RHSA-2026:88835	php:8.2 security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 19:39 UTC
RHSA-2026:88835CVE-2026-109618CVE-2026-109619php:8.2 security update Executive summary Red Hat published advisory RHSA-2026:88835, an Important-rated security update for the php:8.2 module on Red Hat Enterprise Linux 9.4 systems covered by Update Services for SAP Solutions, Extended Life Cycle, AUS, and related subscriptions. The advisory describes two PHP flaws, one of which it says can lead to remote code execution, and the vendor recommends applying the updated packages. The advisory does not state how many systems are affected in practice or whether exploitation has been observed. Technical summary The two issues are CVE-2026-109618, a memory corruption and remote code execution flaw caused by an out-of-memory bailout during request parsing, and CVE-2026-109619, a use-after-free caused by fatal error handling that keeps stale request state. The advisory does not state the attack vector, required preconditions, or CVSS scores, and refers readers to the CVE pages for those details. The fixed package version is php-8.2.13-1.module+el9.4.0+25177+88c847cf.4 for the affected PHP packages, as listed in the advisory. Workarounds are not stated, and no detection guidance is given beyond applying the update per the linked Red Hat article. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88835 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 19:39 UTC Read the advisory
	High	8.1	RHSA-2026:88834	php:8.2 security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 19:29 UTC
RHSA-2026:88834CVE-2026-109618CVE-2026-109619php:8.2 security update Executive summary Red Hat advisory RHSA-2026:88834 provides a php:8.2 security update for Red Hat Enterprise Linux 9.6 Extended Update Support and related channels. Red Hat rates it as Important and fixes two PHP vulnerabilities, CVE-2026-109618 (memory corruption leading to remote code execution) and CVE-2026-109619 (use-after-free). The advisory recommends applying the updated php packages. Technical summary The two flaws are a memory corruption issue triggered by out-of-memory bailout during request parsing, which the advisory says can lead to remote code execution, and a use-after-free caused by fatal error handling that retains stale request state. The advisory does not state the attack vector or preconditions beyond these descriptions, and it does not give a CVSS score in the text provided, referring readers to the CVE pages. Fixed package versions are listed as php-8.2.28-1.module+el9.6.0+25176+d8415d54.4 and related module packages, with the update applied through the articles referenced in the Solution section. No workarounds are stated, and no detection guidance or exploitation-in-the-wild information is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88834 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 19:29 UTC Read the advisory
	High	8.5	CVE-2026-91093	A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary... HPHP One Agent Software, HP One Agent	NVD	Oct 23 19:17 UTC
CVE-2026-91093A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary... Executive summary A potential security vulnerability has been identified in HP One Agent, which runs on certain HP PC products. The advisory says it might allow an attacker to gain higher privileges or run arbitrary code. HP is releasing software updates to mitigate the issue. Technical summary The advisory describes a potential privilege escalation and arbitrary code execution vulnerability in HP One Agent. The vulnerability class, attack vector, and preconditions are not stated. Affected versions are not stated, and fixed versions are not stated beyond HP releasing software updates. Workarounds are not stated. No detection guidance is given, and exploitation status and CVSS score are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HP HP One Agent Software HP One Agent NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	Medium	5.3	CVE-2026-115845	An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code... AWSAWS MCP Server	NVD	Oct 23 19:17 UTC
CVE-2026-115845An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code... Executive summary A weakness in the Python code validator of the run_script tool in AWS MCP Server could let an authenticated user run arbitrary code inside their own isolated session. The advisory says AWS has already fixed the issue on its side and no customer action is required. Technical summary The flaw is an incomplete list of disallowed inputs in the Python code validator of the run_script sandbox, which is a validation bypass that could allow arbitrary code execution. An authenticated remote user could exploit it with a crafted script, and the advisory says the code would run only within their own isolated session environment. The advisory states the fix was applied service-side. Affected versions are given as N/A because the service is managed and exclusively hosted. No fixed version number is stated because the fix is service-side, and no CVSS score, exploitation status, or detection guidance is stated. Per the advisory, no workaround is needed if run_script is used only to run Python scripts that make AWS API calls. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Amazon Web Services AWS MCP Server Summarized from aws.amazon.com/security/security-bulletins/2026-149-aws Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects AWS AWS MCP Server NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	High	7.4	CVE-2026-115570	Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS electron, Node.js, Chromiumelectron, Node.js, Chromium	NVD	Oct 23 19:17 UTC
CVE-2026-115570Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS Executive summary The advisory is a commit diff for Electron, a framework for building desktop applications, and it adds a certificate blocklist that treats certificate chains containing certain public keys as revoked. The advisory does not describe a vulnerability by name, does not state a severity rating, and does not give a CVSS score. Its text does not include a vendor recommendation beyond the patch itself. Technical summary The change adds SHA-256 public key hash (SPKI) blocklist entries to Chromium's network code and to Node.js TLS, using a wrapped X509_verify_cert callback that reports X509_V_ERR_CERT_REVOKED when a blocked key appears in a chain or in peer-sent certificates. The advisory does not state a vulnerability class, a CVE-specific description, attack vector, or preconditions for exploitation. Affected and fixed versions are not stated, and no workaround is described beyond the patches themselves. The advisory does not state whether exploitation has occurred in the wild, and it gives no detection guidance beyond the test specification that checks for CERT_REVOKED results. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/electron/electron/commit/093…6e225137bf2af755fbcc Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects electron Node.js Chromium electron Node.js Chromium NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	Low	3.3	CVE-2026-115569	Fallow is a codebase intelligence tool for TypeScript and JavaScript fallow-rs, @fallow-cli, Fallowfallow-rs fallow, @fallow-cli fallow-node, fallow-rs fallow-cli, fallow-rs fallow-core, Fallow	NVD	Oct 23 19:17 UTC
CVE-2026-115569Fallow is a codebase intelligence tool for TypeScript and JavaScript Executive summary Fallow, a codebase analysis tool for TypeScript and JavaScript, had a flaw that let its Jest and Vitest project settings read config files located outside the project folder. The advisory describes this as a security issue but does not state a severity score, and the fix is included in the project's changes shown in the advisory. Technical summary The flaw is a path containment issue (reading files outside the intended root) in how Fallow resolves Jest projects entries, Vitest test.projects entries, Vitest inline project extends paths, and script --config paths. Preconditions include a project config that names an absolute path, a path with dot segments, a glob, or a symlink pointing outside the project root. The fix adds canonicalization-based checks so only files inside the project root are read, and glob base paths outside the root are skipped; the advisory's diff also adds a Jest glob escaping fix for directory names containing square brackets. Affected and fixed version numbers are not stated in the advisory, and no CVSS score is stated. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/fallow-rs/fallow/commit/75c0…e65b446343989f4c5649 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Affects fallow-rs @fallow-cli Fallow fallow-rs fallow @fallow-cli fallow-node fallow-rs fallow-cli fallow-rs fallow-core Fallow NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	High	7.1	CVE-2026-112342	Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based... Tandoor RecipesTandoor Recipes	NVD	Oct 23 19:17 UTC
CVE-2026-112342Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based... Executive summary The advisory states that Tandoor Recipes before 2.7.0 contains a flaw that lets authenticated users keep stale group-based access after permissions change. The text is cut off, so the full impact is not stated. The advisory does not state a severity score, and no vendor recommendation beyond upgrading to 2.7.0 or later is clearly stated in the excerpt. Technical summary The flaw is described as an improper cache-key design in cookbook/helper/permission_helper.py that lets authenticated users retain stale group-based permissions. The diff changes the cache key from user primary key alone to include the space primary key, and moves recipe permission checks into a shared helper, with related checks added to the serializer. The affected version is stated as before 2.7.0; the exact fixed version is stated only as 2.7.0 in the description. No CVSS score, workaround, exploitation status, or detection guidance is stated in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/TandoorRecipes/recipes/commi…658849eed5686294d5e9 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tandoor Recipes Tandoor Recipes NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	High	7.6	CVE-2026-115863	ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message ConnManConnMan	NVD	Oct 23 18:17 UTC
CVE-2026-115863ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message Executive summary The advisory says ConnMan through version 2.0 contains a stack-based buffer overflow that can be triggered by a DHCPv6 Reply message. The provided text is mainly a 2013 git commit that adds domain search list parsing to the DHCPv6 client, and it does not state a severity rating or a vendor recommendation. Technical summary The flaw is described as a stack-based buffer overflow, triggered through a DHCPv6 Reply message handled by the gdhcp client code. The quoted commit adds a get_domains function in gdhcp/client.c that copies data into a fixed-size stack buffer (char dns_name[NS_MAXDNAME + 1]) using strncpy with a length of NS_MAXDNAME and then walks the value buffer using length bytes taken from the packet. The advisory does not state the attack vector details beyond a DHCPv6 Reply message, the required network position, or whether authentication is needed. Affected versions are stated only as through 2.0, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/pub/scm/network/connman/…4fb4b03fe2a12420d280 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affects ConnMan ConnMan NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	Medium	6.9	CVE-2026-115813	Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal... AWS, Amazon Web ServicesAWS multi-model-server, Amazon Web Services Multi Model Server	NVD	Oct 23 18:17 UTC
CVE-2026-115813Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal... Executive summary Amazon Web Services Multi Model Server (MMS), an open source tool for serving machine learning models, has two issues affecting all released versions up to and including 1.1.11, and the advisory describes the one for CVE-2026-115813 as allowing the management interface to be directed to make requests to unintended network destinations. The advisory does not give a severity score, but the bulletin is labeled Important and notes that the management interface needs no authentication, so exposed deployments are at higher risk. MMS is end of life with no fixed version, so the vendor recommends migrating to a supported model-serving solution. Technical summary CVE-2026-115813 is a server-side request forgery flaw in the model download path, where the unauthenticated MMS management interface can be made to send requests to unintended network destinations. The advisory says deployments that bind the management interface to a network-accessible address are at increased risk. Affected versions are stated as <=1.1.11 (all released versions). No fixed version is available or planned, so the advisory provides no fixed version. The workaround is to bind the management interface to the loopback address when inference and management use separate ports, and to avoid passing externally supplied URLs to the model-download path; the advisory notes this is not available in SageMaker-style deployments, where management shares the inference port. The advisory does not state any detection guidance, CVSS score, or evidence of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from aws.amazon.com/security/security-bulletins/2026-148-aws Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects AWS Amazon Web Services AWS multi-model-server Amazon Web Services Multi Model Server NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	Critical	9.3	CVE-2026-115812	Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a... AWS, Amazon Web ServicesAWS multi-model-server, Amazon Web Services Multi Model Server	NVD	Oct 23 18:17 UTC
CVE-2026-115812Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a... Executive summary Amazon Web Services Multi Model Server (MMS) versions 1.1.11 and earlier have two issues that could let an attacker run code or reach unintended network destinations. The advisory says MMS has reached end of life, no fixed version is available, and AWS recommends migrating to a supported model-serving solution. Technical summary CVE-2026-115812 is a relative path traversal in model archive extraction, letting a crafted archive write files outside the intended directory and potentially execute code with the MMS process privileges. CVE-2026-115813 is an issue in the model download path that could let the management interface make requests to unintended network destinations (server-side request forgery class). The management interface does not require authentication, and risk is increased when it is bound to a network-accessible address. Affected versions are stated as <=1.1.11 (all released versions); no fixed version is available or planned. The advisory gives workarounds: bind the management interface to loopback on separate ports and avoid passing external URLs to the download path, but notes this is not available in every configuration, such as the SageMaker-style deployment where management shares the inference port. No detection guidance or exploitation-in-the-wild status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from aws.amazon.com/security/security-bulletins/2026-148-aws Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects AWS Amazon Web Services AWS multi-model-server Amazon Web Services Multi Model Server NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	Medium	5.8	CVE-2026-115567	Tokio is a runtime for writing applications with Rust tokio-rs, Tokiotokio-rs tokio, Tokio	NVD	Oct 23 18:17 UTC
CVE-2026-115567Tokio is a runtime for writing applications with Rust Executive summary This advisory is a NIST NVD entry for CVE-2026-115567 and describes a code change to the Tokio runtime for Rust, which is a library for writing asynchronous applications. The advisory text does not state the severity, a CVSS score, or the impact of the change, and it does not name a fixed release. The vendor's recommended action is not stated in the text provided. Technical summary The text shows a diff to Tokio's timer code that changes how timer entries hold a reference to the runtime handle, moving the handle into TimerEntry and adding a drop implementation that cancels the entry. It does not state the vulnerability class, the attack vector or preconditions, or any CVE description. Affected versions, fixed versions, workarounds, and detection guidance are not stated in the advisory. Exploitation status and a CVSS score are also not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/tokio-rs/tokio/commit/2b4eba…f3e5f4a97ff4f6fa28d0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects tokio-rs Tokio tokio-rs tokio Tokio NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	High	7.4	CVE-2026-110975	A flaw was found in Kruize Autotune KruizeKruize Autotune	NVD	Oct 23 18:17 UTC
CVE-2026-110975A flaw was found in Kruize Autotune Executive summary Kruize Autotune exposed the stored login secrets for its monitoring data sources, including passwords, tokens, API keys, and OAuth2 client secrets, to any client that can reach the service. Anyone who could reach the service could take these credentials and reuse them against the backing monitoring systems. The advisory says the fix is in Autotune 0.11.2, which removes the secrets from the affected responses and tightens the CORS policy. Technical summary The flaw is an information exposure caused by serializing datasource objects with default Gson settings and no field exclusion, classified as CWE-256 (Plaintext Storage of a Password) in the advisory's references. The REST API has no authentication layer, so any client with network access to the service can call GET /datasources or the datasource-metadata endpoint and read cleartext credentials. The advisory states that the NodePort, LoadBalancer, and OpenShift Route configurations make the service remotely reachable. The issue is fixed in Autotune 0.11.2 by a Gson exclusion strategy on AuthenticationConfig and a deny-by-default CORS handler. The advisory states that credentials stored in cleartext at rest in the kruize_authentication table are not addressed by this fix. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-110975 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affects Kruize Kruize Autotune NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	High	8.3	CVE-2026-87901	Improper sanitization in the registration module allows reflected Cross-Site Scripting. phpBBphpBB	NVD	Oct 23 17:17 UTC
CVE-2026-87901Improper sanitization in the registration module allows reflected Cross-Site Scripting. Executive summary A flaw in the registration module of an unnamed product allows reflected cross-site scripting, which lets an attacker run scripts in a user's browser. The advisory does not state a severity score or a vendor recommendation. Technical summary The vulnerability class is reflected cross-site scripting caused by improper input sanitization in the registration module. The advisory does not state the attack vector details beyond the reflected nature of the flaw, and it does not state the preconditions for exploitation, such as whether user interaction is required. Affected product names and versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affects phpBB phpBB NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.3	CVE-2026-115810	Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to... Tandoor RecipesTandoor Recipes recipes, Tandoor Recipes	NVD	Oct 23 17:17 UTC
CVE-2026-115810Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to... Executive summary Tandoor Recipes versions before 2.7.0 contain a server-side request forgery flaw in the Pestle importer. Authenticated users with low privileges could make the server send requests to destinations they choose. The advisory's release notes say the issue was fixed in version 2.7.0, and the advisory text does not state a severity rating. Technical summary The flaw is a server-side request forgery (SSRF) in the Pestle importer, reachable by authenticated low-privileged users. The advisory text is truncated, so the full attack details, exact preconditions beyond authentication, and any CVSS score are not stated. The release notes for 2.7.0 list a fix for the pestle importer SSRF issue under GHSA-xq7g-9q95-vjc6, and the fix is in version 2.7.0, so upgrading to 2.7.0 or later is the remedy stated. No workaround or detection guidance is stated in the advisory text. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/TandoorRecipes/recipes/releases/tag/2.7.0 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tandoor Recipes Tandoor Recipes recipes Tandoor Recipes NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	4.8	CVE-2026-106074	A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... Node.js, c-ares, OpenSSLOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... Executive summary This advisory covers many security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a Brotli decoder flaw the advisory says could lead to remote code execution. The advisory rates the highest severity issue as HIGH and says updated versions are available, with releases on or shortly after October 21, 2026. Users should upgrade to the fixed Node.js versions listed (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include DNS name truncation at NUL bytes, TLS hostname verification bypasses involving non-canonical IPv4 spellings and fullwidth digits, a Brotli decoder out-of-bounds write (CVE-2026-111497) that the advisory says can lead to remote code execution, keep-alive socket response confusion, predictable entropy caches in startup snapshots and SEAs, a ZipFile read after failed header validation, a Permission Model wildcard over-grant, and a Permission Model bypass through fs.realpathSync. Attack preconditions are described per issue, such as a certificate issued by a CA trusted by the client and a platform resolver like glibc for one TLS issue, or malformed Brotli input supplied to node:zlib. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, and the advisory does not state which specific versions are affected for each issue beyond the release lines named. Workarounds are not stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affects Node.js c-ares OpenSSL SQLite undici OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.3	CVE-2026-106073	A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks Node.js, c-ares, OpenSSLOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks Executive summary This advisory covers multiple security flaws in Node.js across the 26.x, 24.x, and 22.x release lines, including issues that could let attackers bypass permission controls, spoof TLS certificate identities, or potentially run code through the Brotli decompressor. The advisory rates the highest severity issue as HIGH and says the Node.js project will release fixed versions on or shortly after October 21, 2026. Users should upgrade to the updated Node.js releases listed in the advisory (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include a NUL byte truncation in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, an out-of-bounds write in the bundled Brotli decoder that the advisory says can lead to remote code execution, a keep-alive socket response-injection issue, a crypto entropy cache saved into snapshots, a ZipFile prefix-bytes issue, a wildcard radix lookup over-grant in the Permission Model, and a fs.realpathSync permission bypass. Attack preconditions are described per issue, such as an application resolving attacker-influenced hostnames, a certificate issued by a trusted CA for numeric DNS SANs, or a permission model with restricted --allow-fs-read. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, but the advisory does not state which specific version fixes each individual issue. Workarounds and detection guidance for these issues are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects Node.js c-ares OpenSSL SQLite undici OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.7	CVE-2026-106072	A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... Node.js, c-ares, OpenSSLOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... Executive summary This advisory covers CVE-2026-106072, a flaw in Node.js TLS hostname verification that can let a certificate meant for a DNS name be accepted for certain IP address spellings. The advisory rates the highest severity in this release as HIGH and covers several other Node.js issues in the same security release, but it does not give a severity for CVE-2026-106072 itself, which is listed as medium. The recommended action is to upgrade to the fixed Node.js releases named in the advisory, Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The flaw is improper certificate validation in tls.checkServerIdentity(): non-canonical IPv4 spellings such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 and 127.1 are not treated as IP addresses, so a certificate with only a numeric DNS SAN can authenticate an IP endpoint. Exploitation requires a certificate with a numeric DNS SAN issued by a CA the client trusts, and a platform resolver that accepts these spellings, such as glibc. The advisory says affected versions are Node.js 26.x, 24.x and 22.x, and gives fixed versions as Node.js v22.23.4, v24.22.1 and v26.12.1. No workaround is stated in the advisory, and no detection guidance is stated for this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L Affects Node.js c-ares OpenSSL SQLite undici OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.6	CVE-2026-106071	A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... Node.js, The Node.js Project, c-aresOpenSSL, undici, Node.js node, c-ares, SQLite, The Node.js Project Node.js	NVD	Oct 23 17:17 UTC
CVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... Executive summary This advisory covers a low-severity flaw in the Node.js Permission Model, which is meant to restrict file access for Node.js programs. The flaw affects Node.js 26.x and can let code read files outside a wildcard read rule, such as reading /etc/passwd when only /etc/passwd.* is granted. The advisory rates it LOW and points users to the Node.js 26.x security release, Node.js v26.12.1, which is listed alongside the other fixes. Technical summary The flaw is in Node.js Permission Model filesystem enforcement, where the radix tree lookup for wildcard --allow-fs-read or --allow-fs-write rules stops comparing early when the requested path is shorter than the grant prefix, so the path is treated as a match. The advisory says it requires a wildcard grant sitting directly under the root of the permission tree, for example when it is the only grant for that scope, and that the attacker needs code running under --permission. It affects Node.js 26.x only. The advisory does not state a fixed version specifically for this CVE, though it lists Node.js v26.12.1 as the release for the 26.x line. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affects Node.js The Node.js Project c-ares OpenSSL SQLite undici OpenSSL undici Node.js node c-ares SQLite The Node.js Project Node.js NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.7	CVE-2026-106070	A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... Node.js, Brotli, c-aresOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite, Brotli	NVD	Oct 23 17:17 UTC
CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... Executive summary This advisory covers a batch of security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a high-severity Brotli decoder memory corruption issue that the advisory says could lead to remote code execution. The Node.js Project recommends updating to the fixed releases it names (v22.23.4, v24.22.1, v26.12.1) on or shortly after October 21, 2026, since end-of-life versions are always affected. Technical summary The advisory describes several vulnerability classes: an out-of-bounds write in the Brotli decoder (CVE-2026-111497, high) triggered by malformed compressed input passed to node:zlib, DNS name truncation at NUL bytes, TLS hostname verification bypasses for non-canonical IPv4 forms, HTTP keep-alive response confusion, entropy cache reuse in snapshots, ZipFile returning wrong bytes after header validation failure (26.x only), and Permission Model bypasses via wildcard matching and fs.realpathSync. Fixed versions are given as v22.23.4, v24.22.1, and v26.12.1. Workarounds are not stated in the advisory, and no CVSS scores or evidence of in-the-wild exploitation are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Node.js Brotli c-ares OpenSSL SQLite undici OpenSSL undici Node.js node Node.js c-ares SQLite Brotli NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-106069	A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... Node.js, OpenSSL, SQLiteOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... Executive summary This advisory covers a Node.js security release addressing many flaws across the 26.x, 24.x, and 22.x release lines, with the CVE-2026-106069 issue being a TLS hostname verification flaw that can validate a server certificate against a different IP address than the one connected to. The advisory states the highest severity fixed in each release line is HIGH, and the vendor recommends upgrading to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1 on or shortly after October 21, 2026. Fixed versions for the specific CVE are as stated in the release notes; end-of-life versions are noted as always affected. Technical summary CVE-2026-106069 is a TLS hostname verification flaw in tls.checkServerIdentity() where a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1, is normalized as octal by WHATWG URL rules while the OS resolver reads it as decimal, so a certificate for another IP may be accepted; the advisory notes this occurs on some platforms such as macOS. It affects Node.js 26.x, 24.x, and 22.x, and the advisory states the fix is in the listed releases v22.23.4, v24.22.1, and v26.12.1. The advisory does not state any workaround for this CVE, and it does not state whether exploitation has occurred in the wild. The advisory does not give a CVSS score for this CVE and does not provide specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects Node.js OpenSSL SQLite undici c-ares OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105483	A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... Node.js, c-ares, OpenSSLOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... Executive summary This advisory covers a set of security fixes in Node.js releases for the 26.x, 24.x, and 22.x lines, which the advisory says are scheduled for October 21, 2026. The advisory rates the highest severity issue as HIGH and recommends upgrading to the fixed releases, Node.js v22.23.4, v24.22.1, or v26.12.1, since end-of-life versions are always affected by security releases. Technical summary The fixes cover several classes of flaws: TLS hostname verification bypasses for non-canonical or non-ASCII IPv4 spellings (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), DNS name truncation at NUL bytes (CVE-2026-105482), HTTP keep-alive response confusion (CVE-2026-105481), and Permission Model bypasses via fs.realpathSync and wildcard grants (CVE-2026-106073, CVE-2026-106071). Entropy cache leakage into snapshots and SEAs (CVE-2026-106074) and ZIP prefix byte disclosure (CVE-2026-106070) are also addressed. The advisory does not state workarounds for these issues. Detection guidance is not stated. Dependency updates to c-ares, OpenSSL, SQLite, Undici, and a CA certificate list are also included, with the affected release lines given for each. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects Node.js c-ares OpenSSL SQLite undici OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105482	A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() Node.js, c-ares, OpenSSLOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() Executive summary This Node.js security release covers multiple flaws in the 26.x, 24.x and 22.x release lines, including several rated high severity, such as DNS name truncation, TLS hostname bypasses, and a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution. The advisory recommends updating to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1, which are stated as available on or shortly after October 21, 2026. Commercial support for versions past Maintenance LTS is noted as available through OpenJS partners. Technical summary The advisory describes several vulnerability classes: DNS name truncation at NUL bytes (CVE-2026-105482), TLS hostname verification bypasses for fullwidth-digit and leading-zero or non-canonical IPv4 hosts (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), an out-of-bounds write in the Brotli decoder that the advisory says can lead to a crash, memory disclosure, or remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), HTTP keep-alive response confusion, entropy cache leakage into snapshots and SEAs, ZIP header validation bypass, Permission Model wildcard over-grant, and a Permission Model bypass via fs.realpathSync. Affected versions are given per issue, and the fixed versions are listed as Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory does not state workarounds for any issue, and it does not give CVSS scores or exploitation-in-the-wild status. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects Node.js c-ares OpenSSL SQLite undici eMudhra OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.5	CVE-2026-105481	A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request Node.js, c-ares, OpenSSLOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request Executive summary This advisory covers a set of security fixes in Node.js release lines 26.x, 24.x, and 22.x, with several issues the advisory rates as high severity. The highest severity issue fixed in each release line is HIGH, and the advisory says End-of-Life versions are always affected when a security release occurs. The vendor recommends upgrading to the patched releases Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The issues include DNS name truncation at a NUL byte in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, a Brotli decoder out-of-bounds write that the advisory says can lead to a crash, memory disclosure, or remote code execution, a keep-alive HTTP socket issue that accepts a response sent before the request, crypto entropy cache reuse in startup snapshots and SEAs, a zlib.ZipFile header validation bypass, and Permission Model filesystem bypasses via wildcard rules and fs.realpathSync. Affected versions are listed per issue, and the fixed versions are Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory also lists dependency updates to c-ares, ca-cert, OpenSSL, SQLite, and Undici. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N Affects Node.js c-ares OpenSSL SQLite undici OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	8.7	CVE-2026-57845	Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle... Hugging Face, pandasHugging Face datasets, pandas	NVD	Oct 23 16:16 UTC
CVE-2026-57845Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle... Executive summary Hugging Face datasets versions up to and including 5.1.0 contain an insecure deserialization flaw in the deprecated pandas packaged builder. An attacker who gets a victim to load a malicious pickle-backed dataset can run arbitrary Python code with the victim process's privileges, and the advisory rates this High with a CVSS 3.1 base score of 8.8. The advisory describes a narrow code change that blocks the pickle path as the remediation, and it notes that no confirmed fixed release is documented. Technical summary This is CWE-502, deserialization of untrusted data, in the pandas packaged builder, where Pandas._generate_tables() passes an opened file to pandas.read_pickle() before Arrow conversion. The attack vector is network with low complexity, no privileges, and user interaction required (CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and the victim must load the attacker's dataset through load_dataset("pandas", data_files=...). Affected versions are stated as all Hugging Face datasets versions <= 5.1.0. The advisory says a confirmed fixed release is not documented, so the fixed version is not stated. The proposed remediation is an unconditional error in _generate_tables() before any file is opened, with migration to Parquet, Arrow, CSV, JSON, or Dataset.from_pandas(); the advisory notes existing installed packages must be patched or replaced separately. Detection guidance beyond the included proof-of-concept marker-file behavior is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Hugging Face pandas Hugging Face datasets pandas NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-52356	An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting... D-LinkD-Link DAP1160L	NVD	Oct 23 16:16 UTC
CVE-2026-52356An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting... Executive summary An OS command injection flaw affects the D-Link DAP1160L A1_FW101WWb04 device. The advisory describes it as allowing attackers to run arbitrary commands, but the excerpt provided does not state a severity rating. The advisory does not state a vendor fix or upgrade recommendation in the text provided. Technical summary The flaw is an OS command injection in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04, which lets attackers execute arbitrary commands by injecting input. The advisory text is truncated, so the attack vector and authentication preconditions are not stated. Fixed firmware versions are not stated. Workarounds are not stated. CVSS score is not stated. Detection guidance is not stated. The D-Link bulletin text provided is generic boilerplate and gives no specific remediation steps. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from dlink.com/en/security-bulletin Score No CVSS score published. Affects D-Link D-Link DAP1160L NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-50787	e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php e-SIC Livree-SIC Livre esiclivre	NVD	Oct 23 16:16 UTC
CVE-2026-50787e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php Executive summary The e-SIC Livre (esiclivre) application, in version v0.2.2 and earlier, has a CAPTCHA component that can be made to use excessive server resources. An unauthenticated remote attacker could cause slowdowns, errors, or denial of service. The advisory does not state a severity score, and it says no upstream fix was available when the CVE was assigned, so it recommends applying local input validation and resource limits until a fix is released. Technical summary This is an uncontrolled resource consumption flaw (CWE class not stated) in restrito/inc/captcha.php. The GET parameters l, a, tf, and ql set CAPTCHA width, height, font size, and character count, and they are passed to GD image creation and text rendering without upper bounds. The endpoint is remotely reachable with no authentication, and the advisory says exhaustion can cause memory and CPU spikes, timeouts, and HTTP 5xx responses. Affected versions are v0.2.2 and earlier, up to and including commit 0a72b4c9ab89244ec3bd3d7fa0b765850cc9afd7; no fixed version is stated because no upstream fix was available. The advisory recommends integer conversion, min and max bounds, fixed dimensions, character limits, PHP memory and time limits, rate limiting, and freeing image resources. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/brynax/CVE-2026-50787 Score No CVSS score published. Affects e-SIC Livre e-SIC Livre esiclivre NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	Unknown	n/a	CVE-2025-45528	An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF Nitro Software, IncNitro Software, Inc Nitro PDF Pro	NVD	Oct 23 16:16 UTC
CVE-2025-45528An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF Executive summary The advisory says Nitro PDF Pro for macOS version 14.7 has an issue that lets a local attacker run arbitrary code by opening a crafted PDF. The advisory does not state a severity rating, and it does not describe a vendor fix or recommended action. The rest of the page text is unrelated boat dealer website content. Technical summary The advisory describes an issue that allows arbitrary code execution through a crafted PDF, which suggests a memory or input handling flaw, but the specific weakness class is not stated. The attack requires a local attacker and a victim to open the crafted file, as the text indicates local access. Affected version is given as v.14.7 for Nitro PDF Pro on macOS. Fixed versions, workarounds, CVSS score, and detection guidance are not stated. The remaining advisory text is unrelated boat dealer web page content and contains no technical detail. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nitro.com Score No CVSS score published. Affects Nitro Software, Inc Nitro Software, Inc Nitro PDF Pro NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	High	8.1	RHSA-2026:88720	php security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 15:23 UTC
RHSA-2026:88720CVE-2026-109618CVE-2026-109619php security update Executive summary Red Hat has released a security update for PHP on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. The advisory rates it Important and fixes two flaws, one that the advisory says can lead to memory corruption and remote code execution. Technical summary The advisory describes CVE-2026-109618, an out-of-memory bailout during request parsing that leads to memory corruption and remote code execution, and CVE-2026-109619, where fatal error handling retains stale request state leading to use-after-free. The advisory does not state the attack vector, required preconditions, or CVSS scores, and refers readers to the CVE pages for those details. Affected PHP package versions are listed as php-8.0.30-3.el9_6.2 on RHEL 9.6 variants, and the fixed package is the same build. No workarounds are stated, and no detection guidance or evidence of exploitation in the wild is stated. Administrators are directed to the Red Hat article at https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88720 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 15:23 UTC Read the advisory
	High	8.1	RHSA-2026:88725	php security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 15:23 UTC
RHSA-2026:88725CVE-2026-109618CVE-2026-109619php security update Executive summary Red Hat has released a security update for PHP on Red Hat Enterprise Linux 9.4 systems covered by several update and life cycle programs. It fixes two vulnerabilities that Red Hat rates as Important, one of which the advisory says can lead to remote code execution. The advisory says to apply the updated php packages as described in the linked Red Hat article. Technical summary The advisory describes two PHP flaws: CVE-2026-109618, an out-of-memory bailout during request parsing that leads to memory corruption and remote code execution, and CVE-2026-109619, where fatal error handling retains stale request state and causes a use-after-free. The advisory does not state the attack vector, required preconditions, or any authentication requirement in detail, and it does not give a CVSS score in the text provided. The fixed package version is php-8.0.30-1.el9_4.2, but the advisory does not state the affected (pre-fix) versions. No workarounds, mitigations, or detection guidance are stated, and exploitation in the wild is not stated. Defenders should apply the listed updated packages. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88725 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 15:23 UTC Read the advisory
	High	8.6	CVE-2026-58497	Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP olo-dot-io, ZenAlexaolo-dot-io Uni-CLI, ZenAlexa @zenalexa/unicli	NVD	Oct 23 15:17 UTC
CVE-2026-58497Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP Executive summary Uni-CLI, a command interface tool for websites, browsers, desktop applications, and MCP, has a flaw in its legacy HTTP MCP transport that let a malicious web page reach a local Uni-CLI server when the user had started that transport. The advisory rates the issue High severity. The vendor recommends upgrading to version 0.225.2 or later, or avoiding browser-originated traffic to the legacy HTTP MCP transport until the upgrade is possible. Technical summary The weakness is an origin validation error (CWE-346) combined with cross-site request forgery (CWE-352). The legacy stateless HTTP MCP path on loopback did not check browser Origin headers before routing, so a web page could send a CORS simple POST with text/plain content to the local /mcp endpoint and drive tools/call requests. The precondition is that the user has started the local MCP HTTP transport. Affected versions are stated as less than 0.225.2, and the patched version is 0.225.2, which moves the Origin policy into a shared guard and rejects non-loopback browser Origins with HTTP 403. The advisory states the workaround as avoiding exposure of the legacy HTTP transport to browser traffic and using stdio or Streamable HTTP instead. No detection guidance and no CVSS score are stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/olo-dot-io/Uni-CLI/security/…/GHSA-v3f4-w7r7-v3hm Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects olo-dot-io ZenAlexa olo-dot-io Uni-CLI ZenAlexa @zenalexa/unicli NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.3	CVE-2026-55486	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55486The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application's IIIF authorization code, where unvalidated origin values could be reflected into a script block. The text does not state a severity rating, affected version range, or fixed version, and it does not give a clear recommended action beyond the code change shown. Technical summary The change adds strict validation of the origin parameter against a pattern for scheme://host[:port] and rejects invalid values with HTTP 400 in the login and token services. It also adds an escaping function for origin values written into a JavaScript string inside a script tag in the token service response, which suggests a script injection or breakout weakness, though the advisory text does not explicitly name a vulnerability class, CVE-specific attack vector, or required preconditions. Affected versions are not stated, fixed versions are not stated, and no workaround or detection guidance is provided in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…7dfe3958ad2bbcff2d0b Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-55465	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55465The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a set of code changes to the Goobi viewer, a web application for displaying digitised material. The changes address several issues, including Solr query injection risks on the spatial search endpoint and a deprecated token-in-URL authentication path. The advisory text does not state a severity rating, and it does not say whether these changes correspond to a specific exploitable vulnerability with a CVSS score. Technical summary The diff shows several hardening changes: a deprecated fallback that accepts the web API token as a URL query parameter (logged as a warning, removal planned on or after 2027-05-28), input validation on the solrField and region parameters of the spatial search endpoint to block Solr query syntax, and passing filterQuery through SolrTools.cleanUpQuery to strip Solr local-params. The buildClearCacheUrl method was changed to stop placing the token in the URL and the caller now sends it as a header. The advisory does not state the vulnerability class, the attack preconditions, affected versions, fixed versions, or a CVSS score. No workaround or detection guidance beyond the WARN log message is stated. The commit references GVC-2026-17 and GVC-2026-20, which the advisory does not further describe. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…c387e5a0d0d3875bf633 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	6.5	CVE-2026-55463	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55463The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a change to the Goobi viewer web application that adds origin checks and authorization checks to several WebSocket endpoints, which are the parts of the software that handle live connections from browsers. The advisory does not state a severity rating, a CVSS score, or whether the issue has been exploited. The vendor's recommendation is not stated in the text provided. Technical summary The advisory is a code diff rather than a conventional vulnerability description, and it does not state a vulnerability class, CVSS score, or affected or fixed version numbers. The changes add an Origin header check (intended to guard against cross-site WebSocket hijacking) that is off by default and enabled through a new configuration setting, and add user authentication and campaign permission checks to WebSocket endpoints such as CampaignEndpoint, DownloadTaskEndpoint, LogViewerEndpoint, and UserEndpoint. The advisory does not state the attack vector, the preconditions for exploitation, or any workaround beyond enabling the new setting. It does not state the affected versions, the fixed versions, or any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…4a1ee6753de65cbe3412 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.4	CVE-2026-55459	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55459The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application's OpenID login handling, where the login token checks were not strict enough. The advisory does not state a severity rating or any exploitation details, and it does not name a fixed release version. Technical summary The change addresses weak validation of OpenID Connect ID tokens in the authentication endpoint. The previous code compared the nonce only when present and checked the audience claim outside the token verifier, which allowed possible cross-relying-party token replay. The patch passes the client ID into verifyOpenIdToken, requires audience, exp and iat claims to be present, adds a 60 second acceptance leeway, and rejects missing session or token nonces. The advisory does not state the vulnerability class by name, the CVSS score, affected or fixed version numbers, workarounds, or detection guidance, and these are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…d21644592efd6cf87933 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.4	CVE-2026-55457	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55457The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a change to the Goobi viewer, a web application for displaying digitised material, that fixes how REST API access is authorized. The text provided is a code diff rather than a full vulnerability description, so the severity and impact are not stated. The advisory does not state a vendor recommendation beyond the code change itself. Technical summary The diff changes the AuthorizationFilter checkPermissions method so that when the configured webapi.authorization.token is blank, REST API access is rejected, and blank supplied tokens are rejected before comparison. The comparison still uses MessageDigest.isEqual for constant-time comparison. The advisory does not name a CVE-specific vulnerability class, attack vector, affected version range, fixed version number, CVSS score, workaround, or exploitation status. Those details are not stated in the provided text. The diff adds unit tests covering empty tokens and empty configured tokens, but gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…b440871b50181f04716d Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-55444	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55444The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a flaw in the Goobi viewer web application, a tool for displaying digitised material in a browser, in its RSS feed handling. The text is a code diff of a fix to the RssResolver servlet, and it does not state how severe the issue is or give a CVSS score. The change is presented as a fix, and the advisory does not state any version numbers or other steps for administrators. Technical summary The diff suggests the weakness is an access-control bypass in the RSS servlet, where access-condition text was concatenated onto the user query so boolean operators in the q parameter could make the access restriction optional. The fix passes the access suffix as a separate filter query instead. The advisory does not state the vulnerability class, the attack preconditions, affected versions, fixed versions, workarounds, or any detection guidance. Those details are not stated in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…ea236be0d86e08948f6b Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-55442	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55442The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer, a web application for displaying digitised material in a browser. The flaw concerns how search query strings are cleaned up, which could let crafted input change search behaviour and return far more records than intended. The advisory text shown does not state a severity rating or a fixed release version. Technical summary The change rewrites the cleanUpQuery method in SolrTools.java to replace a greedy brace-stripping regex with a placeholder-based approach that keeps a whitelist of internal Solr local parameters (join and terms) and strips other brace-delimited blocks, including double-wrapped injections. The prior regex is described as stripping inner closing braces and producing a near-match-all query that returned roughly the entire index. The vulnerability class appears to be Solr query injection through local parameters; the attack vector and preconditions are not explicitly stated in the advisory text. Affected and fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is given. Added unit tests cover stripping of single and double brace local parameters, graph and function query injection, and retention of the terms parameter. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…a46b98bb9b6a88748a4e Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.1	CVE-2026-55222	Isar is an integration system for automated root filesystem generation ilbers, Isarilbers isar, Isar	NVD	Oct 23 15:17 UTC
CVE-2026-55222Isar is an integration system for automated root filesystem generation Executive summary Isar, a tool that builds Linux root filesystems, has a flaw where the apt trusted GPG key directory is owned by the user running Isar instead of root. An unprivileged user inside the built image whose ID matches that calling user could alter or add trusted keys, which could weaken apt repository integrity protection. The advisory rates it Moderate with a CVSS 3.1 base score of 5.1 and recommends applying the patch or manually changing the directory owner to root. Technical summary The weakness is improper ownership of the /etc/apt/trusted.gpg.d directory, which is created during bootstrap and owned by the calling user rather than root, so this is a local integrity issue (CVSS vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). Exploitation requires that the calling user's ID match an unprivileged user in the image, and the advisory states an attacker would also need to manipulate a remote repository or intercept non-secure communication with it. The issue has no impact on images using an immutable rootfs or where apt is never invoked. Affected versions are stated as >= 0.11, and the patch is identified as commit 29e84ed301c8 ('[PATCH] mmdebstrap: ensure apt keystore is owned by root'); a fixed release version is not stated. The workaround is to chown the directory to root:root in the setup step, as shown in the provided diff. No CWEs are listed, and detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ilbers/isar/security/advisor…/GHSA-rq66-pfw5-whqq Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affects ilbers Isar ilbers isar Isar NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	8.7	CVE-2026-54668	Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite kitodokitodo-production	NVD	Oct 23 15:17 UTC
CVE-2026-54668Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite Executive summary The advisory covers Kitodo.Production, a workflow management tool for mass digitization that is part of the Kitodo Digital Library Suite. The provided text describes release 3.9.2, a bugfix release that updates dependencies to fix potential security issues, and it does not state a severity rating for any specific vulnerability. Technical summary The advisory text names CVE-2026-54668 only in its header and does not describe the vulnerability class, attack vector, or preconditions. The release notes for Kitodo.Production 3.9.2 include a change that hardens XMLUtils EAD/XML upload parsers against XXE (XML external entity) attacks, which suggests the issue may relate to XML parsing, but the advisory does not explicitly link this change to the CVE. Affected versions are not stated beyond the 3.9.2 release context, and no fixed version is explicitly labeled for this CVE. No workaround, CVSS score, exploitation status, or detection guidance is stated. The release notes also say no database schema changes were made in 3.9.2, so no SQL migration is needed when updating from a previous 3.9 release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/kitodo/kitodo-production/rel…odo-production-3.9.2 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects kitodo kitodo-production NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.9	CVE-2026-53942	Conda Organization Infrastructure is a centralized location for infrastructure codes condaconda infrastructure	NVD	Oct 23 15:17 UTC
CVE-2026-53942Conda Organization Infrastructure is a centralized location for infrastructure codes Executive summary The advisory describes a change to the update workflow file in the Conda Organization Infrastructure repository, which is a central location for infrastructure code. The text does not state how serious the issue is, which systems are affected, or what the vendor recommends beyond the diff shown. Technical summary The advisory text is a GitHub diff of a workflow file (.github/workflows/update.yml) that removes an issue_comment trigger and related steps that responded to '@conda-bot render' and '@conda-bot recreate' comments on pull requests. The diff does not describe a vulnerability class, attack vector, or preconditions. Affected and fixed version information is not stated. Workarounds are not stated. Exploitation status is not stated, and no CVSS score or detection guidance is given. The advisory does not name a specific security flaw in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/conda/infrastructure/commit/…b3ad6bf0dd6f9974be55 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L Affects conda conda infrastructure NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-49442	Cacti is an open source performance and fault management framework Cacti, phpseclibcacti, phpseclib	NVD	Oct 23 15:17 UTC
CVE-2026-49442Cacti is an open source performance and fault management framework Executive summary The advisory is a diff of the Cacti project changelog and auth code, and it names several security fixes for the Cacti network monitoring framework. It does not state a severity rating or a single headline impact for CVE-2026-49442 itself, and the vendor's recommended action is not stated. Technical summary The diff lists several Cacti fixes, including a SQL injection in automation_tree_rules.php tied to CVE-2026-46531, a path traversal in Reports format_file, a package signature validation bypass, and a pre-auth open redirect via link.php Referer header. The advisory does not describe which of these is CVE-2026-49442, nor state the attack preconditions, affected versions, fixed versions, workarounds, CVSS scores, or detection guidance. The diff also changes a login error message in lib/auth.php from 'Login failed' to 'Login Failed' and adds a user enumeration entry, but no details about exploitability are given. Affected and fixed version numbers are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Cacti/cacti/commit/ab4baf338…d97d1e2a310fe0af0e3e Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Cacti phpseclib cacti phpseclib NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.8	CVE-2026-46652	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46652The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application for externally downloaded files and resource URLs. The diff adds checks that block non-HTTP(S) schemes and private network addresses, which addresses a server-side request forgery style risk. The advisory text does not state a severity rating, and it does not explicitly describe a vendor recommendation beyond the code change. Technical summary The changes add scheme validation (only http and https are accepted) and a call to NetTools.validateOutboundUrl before downloads and existence checks in ExternalFilesDownloader, which points to an SSRF class of issue. Attack preconditions, the exact vulnerability description, and affected versions are not stated in the text. Fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is provided. The diff also gates external resource URL templates behind a new externalResource[@enabled] configuration flag and includes a filename sanitization change for Content-Disposition headers. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…b42492fbb8af731a2ce5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.8	CVE-2026-46651	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46651The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application that addresses server-side request forgery in its external file download feature, where the application could be made to fetch resources from unintended addresses. The advisory's diff shows changes to restrict download schemes and block private network addresses, but it does not state a severity rating. The advisory does not state what version contains the fix or give a recommendation beyond the code changes shown. Technical summary The diff indicates the flaw relates to server-side request forgery in the external file downloader, which previously accepted file scheme URIs and did not appear to validate destination addresses. The patch restricts downloads to http and https, calls a NetTools outbound URL validation that rejects private network addresses, and builds HTTP clients through a URL-aware helper. The advisory's text does not state the attack vector details, preconditions, affected version ranges, fixed version numbers, CVSS score, workarounds, or exploitation status, and these are not stated. The diff also changes a configuration check so external resource URL templates are only used when the externalResource enabled setting is true, and it removes a pom.xml SNAPSHOT dependency version. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…b42492fbb8af731a2ce5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.5	CVE-2026-46531	Cacti is an open source performance and fault management framework Cacticacti	NVD	Oct 23 15:17 UTC
CVE-2026-46531Cacti is an open source performance and fault management framework Executive summary The advisory describes a flaw in Cacti, an open source performance and fault management framework, in its automation tree rule handling that could allow a stored value to be used in database queries. The advisory text does not state a severity rating or a CVSS score. The fix shown in the pull request adds column allowlist checks, and the advisory does not describe a separate vendor recommendation beyond applying that change. Technical summary The flaw is a second-order SQL injection: the 'field' parameter of automation tree rule items was saved without an allowlist check and later concatenated into SELECT queries in create_all_header_nodes. The advisory indicates the attacker needs to be able to create or store a tree rule item, and a crafted import or duplication path was also discussed. The change adds api_automation_column_exists() checks at save time, at query build time, and in import, duplication, and build_rule_item_filter paths. The advisory does not state affected or fixed version numbers, and does not state any workaround. It also does not state whether the issue has been exploited in the wild. Detection guidance is not stated beyond a log message for skipped invalid items. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Cacti/cacti/pull/7163 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N Affects Cacti cacti NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	6.8	CVE-2026-46347	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46347The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a flaw in the Goobi viewer, a web application for displaying digitised material in a browser. The diff shows the password reset process previously generated reset tokens and new passwords from the system time, which could be predictable. The advisory text does not state a severity rating, and it does not state a vendor recommendation beyond the code change shown. Technical summary The fix replaces predictable password reset values, previously derived from System.currentTimeMillis() through StringTools.generateHash, with values from java.security.SecureRandom in UserBean.java. The activation key used for password reset is now 32 random bytes hex encoded, and the new password is now 4 random bytes hex encoded, which is 8 hex characters. The vulnerability class, attack preconditions, CVSS score, affected version range, fixed version number, workarounds, and exploitation status are not stated in the advisory. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…aa0bd5a68173cd446eef Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	6.5	CVE-2026-46346	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46346The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer, a web application for displaying digitised material, where password reset tokens and new passwords were generated from the system time. The text is a code diff and does not state a severity rating or a vulnerability description, and it does not state a CVSS score. Technical summary The diff changes UserBean.java so that the password reset activation key is built from 32 bytes of java.security.SecureRandom output instead of a hash of System.currentTimeMillis(). It also replaces the 8-character new password, previously derived from the same timestamp hash, with 4 random bytes encoded as hex. The advisory does not state the vulnerability class, attack preconditions, affected versions, fixed version numbers, workarounds, or detection guidance, and it does not state whether exploitation has occurred. The text names no affected product versions beyond the Goobi viewer project itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…aa0bd5a68173cd446eef Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.2	CVE-2026-39902	Cacti is an open source performance and fault management framework Cacticacti	NVD	Oct 23 15:17 UTC
CVE-2026-39902Cacti is an open source performance and fault management framework Executive summary The advisory describes a flaw in Cacti, an open source performance and fault management framework, in which an authenticated administrator could save data input strings containing characters that bypassed the input validation check. The advisory text does not state a severity rating or CVSS score, and it does not describe the vendor's recommended fix in terms of a specific upgrade version. Defenders should review the Cacti release and commit history for the referenced fix and apply it. Technical summary The issue is a validation bypass in cacti_input_string_is_safe() in lib/functions.php, where the blocked character set omitted single quotes, double quotes, redirect operators, subshell parentheses and braces, allowing an authenticated admin to save a data input string that could run shell commands. The advisory describes the attack as requiring admin authentication to save a data input string. Fixed and affected version numbers are not stated in the advisory text, and no workaround is stated. The advisory also adds new cacti_exec() and cacti_exec_string() helpers that use proc_open() with an argv array, and it references GHSA-c4qp-j9r9-fq24 and a later follow-up fix (#7130). Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Cacti/cacti/pull/7112 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects Cacti cacti NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.1	CVE-2026-115478	obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults The-40-Thieves, obsidian-tcThe-40-Thieves obsidian-tc, obsidian-tc	NVD	Oct 23 15:17 UTC
CVE-2026-115478obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults Executive summary obsidian-tc, a Model Context Protocol server for Obsidian note vaults, has a flaw in versions 1.0.1 through 1.31.4 that can cause memory notes to overwrite other notes and leave data inconsistent after failed operations. An authorized caller with the required memory-tool permissions could unintentionally destroy the contents of a vault note outside the entity being written. The advisory states the issue is fixed in version 1.31.4, and that is the recommended action. Technical summary The flaw is a path collision and ownership validation problem in memory note materialization, combined with write ordering errors. Tools such as create_entity, link_entities, rename_entity, unlink_entities and delete_entity write memory notes at computed memory/<type>/<name>.md paths without reliably checking ownership, so a hand-authored note or orphan whose name sanitizes to the same path can have its body overwritten; rename_entity also overwrites a foreign note at its destination path. SQLite rows and relations are changed before filesystem work that can fail, leaving the graph inconsistent with disk. Exploitation requires an authorized caller with the relevant memory-tool permissions, and delete_entity still needs its deletion permission and destructive confirmation. Affected versions are 1.0.1 through 1.31.4 and the fixed version is 1.31.4. The advisory does not state a CVSS score or any workaround beyond noting that restore_note snapshots mitigate overwrites only where snapshots are enabled and the note was previously written by obsidian-tc. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects The-40-Thieves obsidian-tc The-40-Thieves obsidian-tc obsidian-tc NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.1	CVE-2026-115477	obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults The-40-Thieves, obsidian-tcThe-40-Thieves obsidian-tc, obsidian-tc	NVD	Oct 23 15:17 UTC
CVE-2026-115477obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults Executive summary obsidian-tc, a server that lets AI agents work with Obsidian note vaults, has a flaw that could let a client carry out destructive vault operations without a human approving them. The advisory says the flaw affected versions 1.13.0 through 1.31.4 in certain Streamable HTTP deployments, and it is fixed in version 1.31.4. Technical summary The flaw is an approval bypass in the confirmation flow for dispatch-gated tool calls, where the server accepted a call-bound requestState as proof of human approval even though it was issued before the elicitation/create step was asked. It affects versions from 1.13.0 until 1.31.4 on Streamable HTTP deployments with auth.jwtSecret configured and a client declaring elicitation.form support. A client acting incorrectly or under an attacker's control could complete tools marked destructive: true or requiring a scope with a human-in-the-loop floor, while still needing the caller's ordinary tool permissions. The advisory states the fix is in version 1.31.4 and notes the fix cannot stop a malicious client from reporting a fabricated approval. No workaround is stated, and no detection guidance or information on exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects The-40-Thieves obsidian-tc The-40-Thieves obsidian-tc obsidian-tc NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.1	CVE-2026-112333	GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject... GFI Software, GFIGFI Software GFI Archiver, GFI Archiver	NVD	Oct 23 15:17 UTC
CVE-2026-112333GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject... Executive summary GFI Archiver versions before 15.14 contain a stored cross-site scripting flaw in its MailInsights scheduled report feature. The advisory rates it medium severity, with a CVSS score of 5.1, and the vendor's recommended fix is not stated in the text provided. Technical summary The flaw is stored cross-site scripting (CWE-79) in the report name parameter of /Archiver/MailInsights.aspx. An authenticated attacker can store script or HTML that runs in the browser of the user who later views the MailInsights page, because ReportScheduling.btnSaveReport_Click() does not apply output encoding. The CVSS v4.0 vector given is AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, which requires low privileges and user interaction. Affected versions are stated as before 15.14, and the advisory names 15.14 as the fixed release. No workaround, exploitation status in the wild, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from vulncheck.com/advisories/gfi-archiver-s…ia-mailinsights-aspx Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects GFI Software GFI GFI Software GFI Archiver GFI Archiver NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.5	CVE-2026-106765	An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. rog0xrog0x mcp-docker-tools, rog0x mcp-git-tools	NVD	Oct 23 15:17 UTC
CVE-2026-106765An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. Executive summary An npm package named @rog0x/mcp-docker-tools version 1.0.1 is reported to let a remote attacker run arbitrary code. The advisory does not state a severity score, and it does not say whether a fix is available. Technical summary The advisory describes an arbitrary code execution issue in the handleImageList function of @rog0x/mcp-docker-tools 1.0.1, which is reachable from tool arguments. The vulnerability class is described as command injection and the advisory states the attacker is remote. The advisory's text is an NVD description plus a linked GitHub issue that says the same command-injection class exists in the sibling package @rog0x/mcp-git-tools, with arguments reaching a shell without escaping, and that input could arrive through indirect prompt injection. The affected version is stated as 1.0.1, and no fixed version, CVSS score, workaround, or detection guidance is stated. The GitHub issue suggests passing arguments as an array to execFile or spawn, but this is a proposed remediation from the reporter rather than a vendor fix. The reporter has not published technical details and requests a private disclosure channel. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rog0x/mcp-git-tools/issues/1 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects rog0x rog0x mcp-docker-tools rog0x mcp-git-tools NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.5	CVE-2026-106764	An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. rog0xrog0x mcp-docker-tools, rog0x mcp-git-tools	NVD	Oct 23 15:17 UTC
CVE-2026-106764An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. Executive summary A researcher reports that two open-source tool packages for AI assistants, @rog0x/mcp-git-tools and @rog0x/mcp-docker-tools (version 1.0.1), contain a flaw that lets a remote attacker run arbitrary code. The advisory does not state a severity score, and no fixed version or vendor recommendation is given. The researcher has not published technical details and is asking for a private disclosure channel, so defenders should treat these packages as at risk until the maintainers respond. Technical summary The NVD entry describes arbitrary code execution through the resolveBaseBranch function in @rog0x/mcp-git-tools 1.0.1. The researcher describes a command-injection flaw where a documented tool argument supplied by an LLM reaches a shell without escaping, so indirect prompt injection could be a trigger. The researcher also says the same class of issue exists in @rog0x/mcp-docker-tools 1.0.1, but this is not confirmed by the maintainers. The advisory does not state a CVSS score, a fixed version, a workaround, or whether exploitation has been observed. The researcher suggests passing arguments as an array to execFile or spawn, but this is a proposed fix, not a vendor statement. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rog0x/mcp-git-tools/issues/1 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects rog0x rog0x mcp-docker-tools rog0x mcp-git-tools NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.5	CVE-2026-106763	An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. justice8096justice8096 @justice8096/sagemath-mcp-server	NVD	Oct 23 15:17 UTC
CVE-2026-106763An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. Executive summary A command execution flaw has been reported in the @justice8096/sagemath-mcp-server package, version 1.0.1, which lets a remote attacker run arbitrary code through the tool arguments the server accepts. The advisory's own text is a public issue from a researcher asking for a private disclosure channel, and it says the flaw affects local mode only, not the Docker path. The advisory does not state a severity score, a fixed version, or a vendor-issued remediation. Technical summary The flaw is described as command execution reachable through the escapeShellString and sanitizeCode functions, with the input supplied as a tool argument that a connected language model may read, so indirect prompt injection is possible. The advisory says the local-execution path that is auto-selected when Sage is installed locally is affected, and that every math tool exposes the issue. The Docker path is said to pass the program as an argument array and is described as unaffected. The advisory does not state a CVSS score, a fixed version, or a workaround, and it gives no exploitation-in-the-wild information. The researcher withheld technical details pending a private channel and a 90-day coordinated disclosure timeline, so the exact triggering input is not provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/justice8096/sagemath-mcp-server/issues/1 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects justice8096 justice8096 @justice8096/sagemath-mcp-server NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	8.6	CVE-2026-102786	Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 phoca.czphoca.cz Phoca Gallery extension for Joomla, phoca.cz Phoca Gallery	NVD	Oct 23 15:17 UTC
CVE-2026-102786Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 Executive summary The advisory describes a stored cross-site scripting flaw in the Phoca Gallery Joomla extension, versions 4.5.0 through 6.1.5, which the advisory title says can be exploited by an authenticated user. The text supplied does not state a severity rating. The page points to Phoca Gallery version 6.1.6 as a security release, which is the update the vendor recommends. Technical summary The flaw is stored cross-site scripting caused by HTML attribute injection, and the title says it requires an authenticated user. The affected range is given as 4.5.0 through 6.1.5 in the title, and the fixed version is 6.1.6 per the news item about the security release. The advisory does not state a CVSS score, exploitation status in the wild, or a workaround. Detailed technical information, proof of concept, and detection guidance are not included in the text supplied, and the news item only says Read more for details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from phoca.cz Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects phoca.cz phoca.cz Phoca Gallery extension for Joomla phoca.cz Phoca Gallery NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.8	CVE-2026-93640	A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93640A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges Executive summary The advisory describes a local privilege escalation flaw in the optional dnscache package of Zimbra Collaboration Suite, which lets the zimbra Unix account reach files with root privileges. The advisory text provided does not state a severity rating or CVSS score for this specific flaw. The vendor's recommendation given in the text is to update Zimbra using yum or apt and to move to the latest release. Technical summary The flaw is a local privilege escalation in the optional dnscache package, allowing the local zimbra account to access files with root privileges. The attack requires local access as the zimbra account; the advisory does not state the exact preconditions or exploit details. Affected versions and the fixed version for this specific CVE are not stated in the provided text, and no workaround is stated. The surrounding Zimbra advisory table lists many other fixes by release but does not map CVE-2026-93640 to a fix release. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-93639	A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93639A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet... Executive summary A missing authorization flaw in Zimbra Collaboration Suite (ZCS) lets a delegated administrator who has no explicit administrative grants overwrite global Zimlets. The advisory text provided is cut off, so its severity rating is not stated. The fix version and vendor recommendation for this specific CVE are not stated in the provided text. Technical summary The flaw is a missing authorization check (vulnerability class not further specified) that lets a delegated administrator with no explicit administrative grants overwrite global Zimlets in Zimbra Collaboration Suite. The attack requires a delegated administrator account, and the advisory does not say what other preconditions apply. Affected versions, fixed versions, CVSS score, and workarounds are not stated in the provided text. Exploitation in the wild and detection guidance are not stated. The surrounding Zimbra security page lists fixes for other CVEs by release, but none of those entries is confirmed here as relating to CVE-2026-93639. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	6.1	CVE-2026-93638	A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93638A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the... Executive summary The advisory says the Zimbra Collaboration Suite (ZCS) login page has a reflected cross-site scripting flaw that lets an unauthenticated attacker run JavaScript. The advisory does not state a severity score for this CVE, and it does not name a fixed version for it. The linked Zimbra page recommends updating to the latest release. Technical summary The flaw is a reflected cross-site scripting (XSS) issue in the ZCS login page, and the text is cut off before it explains the exact injection point. An unauthenticated attacker can cause JavaScript to run, which implies a victim must be lured to a crafted link, but the advisory excerpt does not state this detail. Affected versions are not stated for this CVE. The CVSS score is not stated, and no fixed version is listed for this CVE in the excerpt. The linked Zimbra security page lists fixes for many other CVEs in releases such as 10.1.21, but it does not map them to CVE-2026-93638. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-93636	An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93636An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through... Executive summary A flaw in Zimbra Collaboration Suite (ZCS) lets a logged-in user see calendar resource details that the system normally does not return. The advisory text is cut off, and it does not state a severity rating for this specific issue. It also does not state a vendor fix or recommended action for this CVE. Technical summary The advisory describes an LDAP filter injection vulnerability in ZCS that lets an authenticated user query otherwise unreturned attributes of calendar resources. The text is truncated at the point where it describes the attack path, so the exact request method and preconditions beyond authentication are not stated. Affected versions are not stated for this CVE, and no fixed version is given in the excerpt. No CVSS score or other severity rating is stated, and no workaround, exploitation status, or detection guidance is stated. The surrounding Zimbra security page lists a different LDAP injection fix (CVE-2026-33369) and does not clearly tie its entries to this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-93634	A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93634A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox... Executive summary The advisory describes a cross-account authorization flaw in Zimbra Collaboration Suite that lets an authenticated user insert forged shared-file records into another user's mailbox. The advisory page is a long list of fixed issues, and the text does not give a single overall severity for CVE-2026-93634 itself. Customers are directed to update Zimbra using yum or apt and to the latest release from the Zimbra download page. Technical summary The flaw is an authorization issue (cross-account) in Zimbra Collaboration Suite that allows an authenticated user to insert forged shared-file records into another user's mailbox. The advisory text provided is truncated and does not describe the attack steps in detail, so the exact preconditions beyond authentication are not stated. Affected version ranges and CVSS score for CVE-2026-93634 are not stated in the supplied text. The page lists fixes in 10.1.21, 10.1.20, and other releases for different issues, but no fixed version is explicitly tied to CVE-2026-93634. No workaround or detection guidance for this CVE is stated. Operators should check the Zimbra Security Advisories page and the blog feed for the specific fixed release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.4	CVE-2026-93633	A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93633A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled... Executive summary The advisory covers a Zimbra Collaboration Suite (ZCS) advisory page listing many security fixes, including a CSS sanitization flaw that lets an authenticated user with Briefcase access publish a document that displays attacker-controlled content. The advisory text provided is truncated and does not give a severity rating for this specific CVE, and it does not state a CVSS score for CVE-2026-93633. The vendor recommends updating Zimbra using the normal package update process and moving to the latest release. Technical summary The flaw is described as a CSS sanitization vulnerability in Zimbra Collaboration Suite that allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content. The attack requires a valid authenticated account with Briefcase access. The advisory text is truncated, so the affected version range and the fixed version for CVE-2026-93633 are not stated. No workaround or detection guidance for this CVE is stated, and no exploitation status is stated. The surrounding Zimbra advisory table lists fixes in release 10.1.21 and earlier releases, but it does not explicitly map CVE-2026-93633 to a specific fix release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.1	CVE-2026-93631	A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93631A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external... Executive summary The advisory describes CVE-2026-93631, a cross-site request forgery flaw in the OAuth extension of Zimbra Collaboration Suite Network Edition that lets an attacker link an attacker-controlled external account. The text is cut off, so the advisory does not state a severity rating for this CVE within the provided text. The vendor's recommendation shown here is to update Zimbra using the latest release and patches, though no specific fixed version is given for this CVE. Technical summary The flaw is a cross-site request forgery in the OAuth extension, which lets an attacker link an attacker-controlled external account, per the truncated description. The attack vector and preconditions beyond this are not stated. The affected versions are not stated, and the fixed version for CVE-2026-93631 is not stated in the provided text. The advisory does not give a CVSS score for this CVE, and no workaround or detection guidance for it is stated. The rest of the page is a general Zimbra security table that does not clearly map to this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zimbra Zimbra Collaboration Suite Network Edition Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-93630	A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93630A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms... Executive summary The advisory says a flaw in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) lets an unauthenticated sender bypass a restriction on forms. The text is cut off, so its severity rating and the exact impact are not stated. The page it came from recommends updating Zimbra to the latest release using yum or apt, but it does not tie that step to this specific CVE. Technical summary The advisory describes a hostname canonicalization vulnerability in the email HTML sanitizers of ZCS, and the description is cut off mid-sentence after mentioning a bypass of a restriction on forms. An unauthenticated sender can trigger it by sending email, and the advisory does not say what other preconditions apply. Affected versions, fixed versions, CVSS score, and workarounds for CVE-2026-93630 are not stated in the text provided. No detection guidance or exploitation status is given for this CVE. The page also contains a large table of other Zimbra fixes, but those entries do not mention CVE-2026-93630 and are not used for this summary. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-93629	An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93629An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user Executive summary The advisory is a CVE record for Zimbra Collaboration Suite (ZCS) describing an organizer authentication flaw that lets an unauthenticated email sender insert calendar invitations attributed to another user. The advisory text does not state a severity score for this CVE, and the vendor's fix guidance for it is not clearly stated in the excerpt provided. Defenders should check Zimbra's security advisory page for the patched release. Technical summary The flaw is an organizer authentication issue in the calendar invitation handling of Zimbra Collaboration Suite, allowing an unauthenticated sender to make an invite appear to come from another user. The advisory excerpt does not state the attack vector details beyond sending email, the affected version range, or a CVSS score for this CVE. The excerpt is a broad Zimbra security advisory listing many other CVEs, and none of its rows explicitly map to this CVE, so the fixed version for this specific issue is not stated. No workaround or detection guidance for this issue is stated. Operators should confirm affected versions and fixes against the vendor's release notes before acting. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-93628	An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-93628An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's... Executive summary The advisory describes an attendee authentication flaw in the email calendar processing of Zimbra Collaboration Suite (ZCS), which lets an unauthenticated sender forge another attendee's identity. The advisory text is cut off, so its stated severity and full details are not available. The fetched page is a Zimbra security advisory listing many fixes, and it recommends updating Zimbra using yum update or apt update. Technical summary The flaw is described as an attendee authentication vulnerability in email calendar processing that allows an unauthenticated sender to forge another attendee's identity. The advisory text is truncated, so the full description, CVSS score, and attack details are not stated. No affected version range or fixed version for this specific CVE is stated in the excerpt provided. No workaround or detection guidance for this CVE is stated. The rest of the page is a general Zimbra security table listing other CVEs with fix versions such as 10.1.21, which are not clearly tied to this CVE in the excerpt. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-93627	An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing... Zimbra, electron, OpenJDKPHP, OpenSSL, electron, Zimbra Collaboration Suite, Apache CXF, Zimbra Desktop, Zimbra Modern Zimbra Desktop, OpenJDK, ClamAV, NGINX, Rsync, Apache HttpClient, Spring Core, Cyrus SASL, Jetty, Perl Compress::Zlib, electron graphiql, TinyMCE, @babel/runtime	NVD	Oct 23 14:17 UTC
CVE-2026-93627An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing... Executive summary The advisory is a Zimbra Collaboration Suite security advisory listing many fixed vulnerabilities, including cross-site scripting, authorization flaws, file inclusion, and command injection issues across multiple releases. The advisory does not describe one single severity level for the set, and most entries have no CVSS score stated. The vendor recommends updating Zimbra to the latest release or patch using yum or apt update. Technical summary The advisory covers a large batch of fixes spanning cross-site scripting, CSRF, SSRF, local and remote file inclusion, XXE, LDAP injection, authorization bypasses, and a command injection in the SNMP monitoring component, among others. Attack vectors and preconditions vary by entry; some require authentication and others are unauthenticated, as noted in individual entries. Fixed versions are listed as written in the table, such as 10.1.21, 10.1.20, 10.1.17, 10.1.16, and older patch levels like 9.0.0 Patch 46, 10.0.15, and 10.1.9. Most entries have CVSS scores listed as TBD, and some have none. The advisory does not state workarounds for most entries, and it gives no detection guidance beyond upgrading. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Apache Apache HTTP Server Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Zimbra electron OpenJDK ClamAV PHP Nginx OpenSSL Rsync Apache Spring Cyrus SASL Jetty Perl TinyMCE @babel PHP OpenSSL electron Zimbra Collaboration Suite Apache CXF Zimbra Desktop Zimbra Modern Zimbra Desktop OpenJDK ClamAV NGINX Rsync Apache HttpClient Spring Core Cyrus SASL Jetty Perl Compress::Zlib electron graphiql TinyMCE @babel/runtime NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	6.2	CVE-2026-57208	Entire CLI hooks into Git workflows to capture AI agent sessions entireioentireio cli, entireio Entire CLI	NVD	Oct 23 14:17 UTC
CVE-2026-57208Entire CLI hooks into Git workflows to capture AI agent sessions Executive summary The advisory describes a path-traversal and arbitrary file write flaw in the Entire CLI, which hooks into Git workflows to capture AI agent sessions. A crafted session identifier read from checkpoint metadata or agent hook input could overwrite files outside the intended directory, and the advisory states this could lead to code execution on the next resume. The advisory does not state a severity score, and the fix is described as merged into the main branch through a pull request; the advisory does not provide a CVSS score or a list of fixed release versions. Technical summary The weakness is a path traversal and arbitrary file write class caused by session, tool-use, and subagent identifiers flowing into filesystem paths without validation during entire session resume, entire checkpoint rewind, and lifecycle hook dispatch. The advisory says an absolute or dot-segment session ID could let transcript bytes overwrite files such as ~/.bashrc, and that Codex and Pi return absolute IDs verbatim. The fix validates IDs at restore and dispatch choke points, hardens ValidateSessionID to reject dot segments and absolute paths, and routes some writes through os.Root. Affected and fixed version numbers are not stated, and no workaround is described. Exploitation in the wild is not stated, and detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/entireio/cli/pull/1365 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Active CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects entireio entireio cli entireio Entire CLI NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.9	CVE-2026-57207	NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox netboxlabs, NetBoxnetboxlabs netbox-mcp-server, NetBox MCP Server	NVD	Oct 23 14:17 UTC
CVE-2026-57207NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox Executive summary The advisory covers NetBox MCP Server, a read-only Model Context Protocol server for NetBox, in release v1.2.1. The text is mostly release notes and does not state how severe the flaw is or what the vendor recommends beyond the listed updates. Impact and severity are not stated. Technical summary The advisory is largely a changelog for NetBox MCP Server v1.2.1 and names a reporter (@fortress07) for responsible disclosure, but it does not describe the vulnerability class, attack vector, or preconditions. Affected versions are not stated beyond the release v1.2.1 itself, and no fixed version is explicitly identified as remediating a specific flaw. The changelog lists dependency bumps for cryptography, pyjwt, python-multipart, gitpython and pygments, and adds optional bearer token authentication for HTTP transport. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/netboxlabs/netbox-mcp-server/releases/tag/v1.2.1 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affects netboxlabs NetBox netboxlabs netbox-mcp-server NetBox MCP Server NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-55826	The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites stape-iostape-io gtm-server-side-wordpress-plugin, stape-io GTM Server Side plugin	NVD	Oct 23 14:17 UTC
CVE-2026-55826The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites Executive summary The advisory covers the GTM Server Side plugin by stape.io, which adds server-side Google Tag Manager tracking to WordPress websites. The text provided does not state how serious the flaw is, and it does not describe a vulnerability or a vendor fix recommendation. Technical summary The advisory text is a copy of the plugin's GitHub repository page and changelog, and it does not describe a specific vulnerability class, attack vector, or preconditions. Affected versions are not stated beyond the repository version v2.1.47 and stable tag 2.1.47, and no fixed version is identified. No workarounds, exploitation status, CVSS score, or detection guidance is given. Vulnerability details should be taken from the NVD entry for CVE-2026-55826 or the vendor's own advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/stape-io/gtm-server-side-wor…-plugin/tree/v2.1.47 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects stape-io stape-io gtm-server-side-wordpress-plugin stape-io GTM Server Side plugin NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	6.5	CVE-2026-55606	odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt openwrtopenwrt odhcpd	NVD	Oct 23 14:17 UTC
CVE-2026-55606odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt Executive summary This advisory describes a batch of security and correctness fixes in odhcpd, the DHCPv6, DHCPv4 and router-advertisement server used by OpenWrt. Several fixes address memory-safety problems reachable from the network, including out-of-bounds reads and writes and a stack overflow from nested relay messages. The advisory does not state a CVSS score or a severity rating, and it does not state whether any of these issues have been exploited in the wild. Technical summary The fixes cover out-of-bounds stack and buffer reads in DHCPv6 self-loop detection, unbounded nested relay-forward recursion, integer wrap in RELAY_MSG length rewriting, and missing length checks on DHCPv4 options, IA_NA/IA_PD options, CLIENT_ARCH and encapsulated DHCPv4 messages on the 4o6 path, plus NDP Neighbor Solicitation hop-limit and ICMP code checks. A stack overflow in the UCI DNR mandatory SvcParam parser is also fixed, and that issue is reachable through configuration rather than the network. The advisory names no affected or fixed version numbers for odhcpd, and it does not state any workaround. Detection guidance is not stated. The commit history is a set of code changes, so the advisory does not provide a separate list of affected releases. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openwrt/odhcpd/pull/401 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Affects openwrt openwrt odhcpd NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Critical	9.8	CVE-2026-53921	odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt openwrtopenwrt odhcpd	NVD	Oct 23 14:17 UTC
CVE-2026-53921odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt Executive summary The advisory concerns odhcpd, the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. The text provided is only a source-code diff of a fix in the DHCPv6 IA handling code, and it does not state how serious the flaw is or what the vendor recommends beyond that patch. Technical summary The diff changes dhcpv6_ia_handle_IAs in src/dhcpv6-ia.c so that the Reconfigure Accept handshake length is computed before the check, adds an extra reconfigure-auth structure size for REQUEST messages, and requires buflen to be at least handshake_len before writing the reconfigure option into the buffer. This suggests a bounds-checking flaw in buffer writes, but the advisory does not name the vulnerability class, attack vector, or preconditions. Affected and fixed version numbers are not stated, and no workaround or detection guidance is given. Exploitation status and CVSS score are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openwrt/odhcpd/commit/032003…b8725c621dd06c36dc03 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects openwrt openwrt odhcpd NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-53920	odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt openwrtopenwrt odhcpd	NVD	Oct 23 14:17 UTC
CVE-2026-53920odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt Executive summary A flaw in odhcpd, the DHCPv6 and router-advertisement server used by OpenWrt, lets an unauthenticated client on the local network read memory from the server, including a stack canary value. The advisory rates it High severity. It lists no patched versions in its header, but its description also says the issue is fixed in a later commit, so the remediation status needs checking against the vendor. Technical summary The flaw is a stack out-of-bounds read (CWE-125 and CWE-126) in dhcpv6_ia_handle_IAs, where a zero-length or short IA_NA or IA_PD option causes the IAID to be read past an 8192-byte receive buffer, and the bytes are reflected in the DHCPv6 reply. The attacker needs network adjacency on the local IPv6 link and a DHCPv6 client packet with a valid Client Identifier, and no authentication is required. Affected versions are listed as 17.01.0 through 25.12.3. The header states patched versions as None, while the description says the issue is fixed in f2275ef (25.12: 719fc3a), and no fixed release version is stated. The advisory provides a minimal patch that rejects IA options shorter than the header and recommends regression tests. No workaround is stated. Detection guidance is not stated beyond the reproducer. Exploitation in the wild is not stated, and no CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openwrt/odhcpd/security/advi…/GHSA-p769-5v73-pc4f Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openwrt openwrt odhcpd NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.8	CVE-2026-53918	odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt openwrtopenwrt odhcpd	NVD	Oct 23 14:17 UTC
CVE-2026-53918odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt Executive summary The advisory covers a code change in odhcpd, the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. The text provided is a source diff with no severity rating, so the advisory does not state how serious the flaw is, and it does not give a specific vendor recommendation beyond the code change itself. Technical summary The diff changes dhcpv6_ia_handle_IAs in src/dhcpv6-ia.c so that a stored pointer to a lease is replaced by a copied 16-byte key and a validity flag, which is used when assigning keys and deciding whether to send a reconfigure. The advisory text does not describe the vulnerability class, attack vector, or preconditions, and it does not state affected versions, fixed versions, workarounds, exploitation status, or a CVSS score. No detection guidance is given. The text contains only the diff and no narrative description of the flaw. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openwrt/odhcpd/commit/26b122…6aff8f98d428b25e2a93 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openwrt openwrt odhcpd NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.8	CVE-2026-50057	A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-50057A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root Executive summary The advisory describes a local privilege escalation flaw in the Zimbra Collaboration Suite MTA package, where the Unix zimbra account can run arbitrary commands as root. The advisory text is a long Zimbra security table and does not state a severity rating or CVSS score for this specific flaw, and it does not state a clear vendor recommendation for it beyond general advice to update to the latest release. Technical summary The flaw is described as local privilege escalation in the ZCS MTA package, allowing the Unix zimbra account to execute arbitrary commands as root. The advisory does not state the attack preconditions beyond requiring local access as the zimbra account, and it does not give affected or fixed version numbers for this specific flaw. No CVSS score, workaround, or exploitation status for CVE-2026-50057 is stated. The advisory points to a general Zimbra update via yum or apt and to the latest download page, but gives no specific fixed build for this issue. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.8	CVE-2026-50056	A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-50056A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root Executive summary The advisory describes a local privilege escalation flaw in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS). It lets the Unix zimbra account run arbitrary commands as root. The advisory does not state a severity score for this specific flaw, and the page is a broad list of Zimbra fixes that does not give specific remediation steps for it beyond general advice to update to the latest release. Technical summary The flaw is a local privilege escalation in the zmmailboxdmgr launcher, allowing a local user holding the Unix zimbra account to execute arbitrary commands as root. The advisory text does not state a CVSS score, the affected version range, or the fixed version for this CVE-2026-50056 entry. Attack complexity and required preconditions beyond local access to the zimbra account are not stated. No workaround or detection guidance specific to this flaw is stated. The surrounding Zimbra page recommends updating via yum or apt to the latest release, but the specific fixed release for this CVE is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-50053	A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-50053A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted... Executive summary The advisory is a Zimbra Collaboration Suite security advisory page that lists many fixed vulnerabilities across recent releases. The specific CVE-2026-50053 entry (request attribute override on /h/* endpoints) is described only in a truncated opening line, and the advisory does not state its severity score. The vendor recommends updating Zimbra to the latest release through its normal update channel. Technical summary The truncated description says unauthenticated requests to /h/* can populate servlet attributes intended for trusted internal use, which is a request attribute override class of flaw. The text does not state the attack preconditions in full, a CVSS score, affected version ranges, or the fixed version for CVE-2026-50053 itself. No workaround or detection guidance is given for this CVE. The page lists fixes in ZCS 10.1.21, 10.1.20 and earlier releases, but none of these entries is explicitly tied to CVE-2026-50053. Defenders should check the Zimbra blog and vendor patch notes for the exact fixed build. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	6.5	CVE-2026-115786	A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and... Zimbra, OpenJDK, NginxPHP, OpenSSL, electron, Zimbra Collaboration Suite, Apache CXF, Zimbra Desktop, Zimbra Modern Zimbra Desktop, OpenJDK, ClamAV, NGINX, Rsync, Apache HttpClient, Spring Core, Cyrus SASL, Jetty, TinyMCE, Apache Log4j	NVD	Oct 23 14:17 UTC
CVE-2026-115786A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and... Executive summary The advisory describes a mailbox quota accounting flaw in Zimbra Collaboration Suite (ZCS) that lets an authenticated user consume another user's mailbox quota by repeatedly sharing items. The text also lists a long set of Zimbra fixes, many with unscored issues, and the advisory does not state a severity rating for the quota flaw. The vendor recommends updating Zimbra with yum or apt to the latest release. Technical summary The quota flaw is an accounting weakness: an authenticated user can repeatedly share and unshare content to consume another user's mailbox quota. The advisory does not state a CVSS score, a fixed version for this specific CVE, a workaround, or detection guidance for it. The listed fixes span many classes, including stored and reflected XSS, LFI, SSRF, CSRF, XXE, authorization bypass, and command injection, with fix releases such as 10.1.21, 10.1.20, and 10.1.17, and most CVSS entries marked TBD. The advisory text is truncated, so the complete list and the fix release for CVE-2026-115786 cannot be confirmed from this text. Affected version ranges for the quota flaw, exploitation status, and vendor-published detection indicators are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Apache HTTP Server Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affects Zimbra OpenJDK Nginx ClamAV PHP OpenSSL Spring Apache electron TinyMCE Jetty Rsync Cyrus SASL PHP OpenSSL electron Zimbra Collaboration Suite Apache CXF Zimbra Desktop Zimbra Modern Zimbra Desktop OpenJDK ClamAV NGINX Rsync Apache HttpClient Spring Core Cyrus SASL Jetty TinyMCE Apache Log4j NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	4.3	CVE-2026-115785	An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-115785An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options... Executive summary The advisory describes an SMTP command injection flaw in the data-source testing feature of Zimbra Collaboration Suite (ZCS). It says an ordinary authenticated user with account options can exploit it, but the text provided is truncated and does not give a severity rating or a fixed version for this specific CVE. The surrounding Zimbra security page lists many other fixes in recent releases, and the vendor's recommendation is to update Zimbra using yum or apt and to upgrade to the latest release. Technical summary The flaw is an SMTP command injection in the data-source testing functionality of Zimbra Collaboration Suite, reachable by an ordinary authenticated user who has account options (the text is cut off before the rest of the preconditions). The advisory excerpt does not state affected version ranges, a CVSS score for this CVE, a fixed version for this specific flaw, a workaround, or any exploitation status. The surrounding Zimbra table lists fixes in 10.1.21 and earlier releases, but it does not map this SMTP injection issue to a fix release. Detection guidance is not stated. Administrators should check Zimbra's security advisory page and the NVD entry for the complete affected version list before relying on any version information. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Low	2.3	CVE-2026-115754	serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized... yahoo, Serialize JavaScriptyahoo serialize-javascript, Serialize JavaScript	NVD	Oct 23 14:17 UTC
CVE-2026-115754serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized... Executive summary The serialize-javascript library, versions from 7.0.1 before 7.1.3, contains a cross-site scripting flaw that lets attackers break out of HTML script elements. The advisory describes this as a cross-site scripting vulnerability but does not state a severity rating or CVSS score. The fix is included in the code changes shown, and the advisory does not state other vendor recommendations. Technical summary The flaw is a cross-site scripting issue in which a script close tag at the very end of a serialized function body is not escaped, so a later value in the output can supply the closing delimiter and break out of a script element. The advisory does not state the attack vector or user interaction required. The vulnerable range is 7.0.1 before 7.1.3, and the fixed version is 7.1.3 as the affected range implies. The advisory shows a patch to index.js changing the SCRIPT_CLOSE_REGEXP lookahead to match end of string, and adds unit tests referencing PSECBUGS-118415. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/yahoo/serialize-javascript/c…db3e70d1a079de108a61 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects yahoo Serialize JavaScript yahoo serialize-javascript Serialize JavaScript NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.5	CVE-2026-115481	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS	NVD	Oct 23 14:17 UTC
CVE-2026-115481baserCMS is a website development framework Executive summary The advisory describes a change to baserCMS, a website development framework, that alters how plugins are installed and what access rules are created for them. The diff shows that plugins without a permission definition previously received full access for all user groups by default, and the change makes that default restricted to administrators. The advisory does not describe the severity, a CVSS score, or a specific vendor recommendation beyond the code change itself. Technical summary The diff changes the default value of the permission parameter from true to false in the plugin install API controller and in the plugin configuration table, and it adds a check so that plugins without config/permission.php get full-access rules only when explicitly chosen during installation. The underlying weakness is an insecure default that grants broad access to non-administrator user groups. The advisory does not state the vulnerability class, CVSS score, attack preconditions, affected version range, fixed version, workarounds, or detection guidance, and it does not explicitly say that the issue is exploitable in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/baserproject/basercms/commit…5572e0e77173c1f1fdb5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Active CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects baserproject baserCMS baserproject basercms baserCMS NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-115480	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS bc-mail	NVD	Oct 23 14:17 UTC
CVE-2026-115480baserCMS is a website development framework Executive summary The baserCMS mail form plugin (bc-mail) had a fix added that enforces image captcha verification on mail form submissions, where the form's captcha setting was not being checked by the API endpoint. The advisory provided does not state a severity rating or the affected and fixed version numbers. The advisory text does not state any vendor recommendation beyond the code change shown. Technical summary The advisory shows a diff to plugins/bc-mail/src/Controller/Api/MailMessagesController.php that adds a check of the auth_captcha setting and a call to BcCaptchaServiceInterface::check before a mail message is created, and it adds integration tests for this behavior. The underlying vulnerability class, such as missing captcha enforcement or bot abuse, is implied by the diff but not named in the advisory. Attack vector, preconditions for exploitation, affected version range, fixed version number, workarounds, and detection guidance are not stated. The advisory also does not state a CVSS score or whether the issue is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/baserproject/basercms/commit…91e54459248f866dcf61 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects baserproject baserCMS baserproject basercms baserCMS bc-mail NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-115479	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS	NVD	Oct 23 14:17 UTC
CVE-2026-115479baserCMS is a website development framework Executive summary The advisory describes a fix in baserCMS, a website development framework, for a flaw in its mail plugin (bc-mail) that let form submitters direct automatic reply emails to arbitrary addresses, including multiple comma-separated addresses, which could be abused to relay mail to third parties. The advisory does not state a severity rating. The fix changes the code to accept only a single valid email address from fields of type email and to validate those fields, but the advisory does not state affected or fixed version numbers or any workaround. Technical summary The change is in the bc-mail plugin, MailMessagesTable.php and MailFrontService.php. Before the fix, the automatic reply recipient fell back to the email or email_1 POST values even when they were not defined form fields, and non-email field types were accepted without format checks, letting a submitter choose arbitrary recipients and relay mail. The fix limits the recipient to fields of type email, trims the value, rejects anything that fails Validation::email, and adds email format validation for email-type fields. The advisory does not state affected or fixed version numbers, a CVSS score, a CWE, exploitation status, or a workaround, and no detection guidance is given beyond the referenced GHSA identifier in the commit text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/baserproject/basercms/commit…351defcb9fb37f69daf1 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects baserproject baserCMS baserproject basercms baserCMS NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.1	CVE-2026-115457	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS, baserCMS bc-blog, baserCMS baser-core	NVD	Oct 23 14:17 UTC
CVE-2026-115457baserCMS is a website development framework Executive summary The advisory describes a set of code changes to baserCMS, a website development framework, that address shortcode injection and loading of arbitrary scripts through shortcode arguments. The advisory text provided does not state a severity rating or a CVSS score, and it does not name a fixed release version. The vendor's recommendation is not stated beyond the code changes shown. Technical summary The changes add a notContainsShortCode validator in BcValidation and apply it to the name and message fields of blog comments in bc-blog, so that visitor input containing registered shortcodes is rejected. A second change in BcGoogleMapsHelper restricts the apiBaseUrl value to Google Maps hosts and URL-encodes the API key, preventing shortcode arguments from loading arbitrary script URLs. The advisory does not state affected or fixed version numbers, a CVSS score, an attack vector rating, or whether exploitation has occurred. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/baserproject/basercms/commit…da7ae67d2dd0ad964eec Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Affects baserproject baserCMS baserproject basercms baserCMS baserCMS bc-blog baserCMS baser-core NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-114624	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS baser-core, baserCMS bc-widget-area	NVD	Oct 23 14:17 UTC
CVE-2026-114624baserCMS is a website development framework Executive summary The advisory is a code change to baserCMS, a website development framework, that hardens how two of its plugins (baser-core and bc-widget-area) handle serialized data. The text does not state a severity rating, and it does not say which versions are affected or what the vendor recommends beyond this code change. Technical summary The diff adds allowed_classes set to false to PHP unserialize calls in BcUtil::unserialize and adds a stripObjects helper in the WidgetArea entity, and its code comments describe the change as a PHP object injection countermeasure. The advisory does not explicitly describe the vulnerability, its attack vector, or its preconditions. Affected versions, fixed versions, a CVSS score, workarounds, and exploitation status are not stated. The advisory also gives no detection guidance, and the changed tests show objects being rejected or dropped rather than restored. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/baserproject/basercms/commit…a4c6b47ad7fb9e2c1529 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects baserproject baserCMS baserproject basercms baserCMS baser-core baserCMS bc-widget-area NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Medium	6.5	CVE-2026-114623	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS, baserCMS bc-theme-file	NVD	Oct 23 14:17 UTC
CVE-2026-114623baserCMS is a website development framework From the advisory baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects baserproject baserCMS baserproject basercms baserCMS baserCMS bc-theme-file NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-114622	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS bc-theme-file	NVD	Oct 23 14:17 UTC
CVE-2026-114622baserCMS is a website development framework Executive summary The advisory describes a path traversal flaw in baserCMS, a website development framework, that let requests reach files outside the theme directory, including reading and copying files on the server. The advisory text provided shows code changes that add path boundary checks, but it does not state a severity rating, and no CVSS score is stated. The advisory provides a patch as its remedy, and it does not state a workaround. Technical summary The flaw is a path traversal weakness (CWE class not stated) in the theme file management plugin bc-theme-file. Admin web routes built the fullpath from URL input without the boundary check used by the API route, so a path containing dot-dot segments could read images, copy source files into the current theme webroot, and write or rename files outside the theme. The attack requires an authenticated admin session, which the diff implies through the admin routes but the advisory does not explicitly state. The fix adds boundary checks in ThemeFilesController::parseArgs, BcThemeFileService, ThemeFilesService and ThemeFoldersService, and checks decoded paths as well. Affected and fixed version numbers are not stated, and no workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/baserproject/basercms/commit…c4b42d313983329aa162 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects baserproject baserCMS baserproject basercms baserCMS bc-theme-file NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.8	CVE-2026-114621	baserCMS is a website development framework baserproject, baserCMSbaserproject basercms, baserCMS	NVD	Oct 23 14:17 UTC
CVE-2026-114621baserCMS is a website development framework Executive summary This advisory describes a SQL injection flaw in baserCMS, a website development framework. The text shows the fix adds filtering of database query parameters in the admin and admin API areas, but it does not state how severe the flaw is or give a CVSS score. The advisory does not state a fixed version number or any vendor recommendation beyond the code change. Technical summary The flaw is a SQL injection caused by request query parameters such as contain[...][conditions], contain[...][fields], finder and order being passed through to service getIndex() or get() methods, allowing SQL to be injected into WHERE, SELECT or ORDER BY clauses via EagerLoader. The fix removes ORM structure keys in a common controller base method called from beforeFilter, and adds order to the reserved key list in the query parameter trait; the Api prefix is excluded because those controllers reject contain with 403. Affected and fixed version numbers are not stated, and no CVSS score is given. No workaround or exploitation-in-the-wild information is stated, and no detection guidance is given beyond the added tests. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/baserproject/basercms/commit…1fa4647ba094caf8dcb6 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects baserproject baserCMS baserproject basercms baserCMS NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	Critical	9.3	CVE-2026-114357	Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to... DJIDJI CrystalSky ZS600C	NVD	Oct 23 14:17 UTC
CVE-2026-114357Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to... Executive summary A missing authentication flaw in the Android Debug Bridge daemon on DJI CrystalSky ZS600C devices lets an attacker obtain a shell without logging in. The advisory gives a CVSS 4.0 base score of 9.3, which indicates critical severity. The advisory does not state a vendor fix or recommended remediation. Technical summary The flaw is missing authentication for a critical function in adbd, which allows an unauthenticated shell running as uid 2000 and a foothold for privilege escalation to root. The affected firmware range is v0.3.9.7 through v0.6.6.9. The device ships with ro.adb.secure=0 and USB ADB enabled by default, so USB access is one preconditions path. ADB over TCP is not enabled by default but can be enabled through /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555', after which the shell is reachable over the network. The advisory does not state a fixed version, a workaround, exploitation status, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X Affects DJI DJI CrystalSky ZS600C NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.0	CVE-2026-114356	Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with... DJIDJI CrystalSky ZS600C	NVD	Oct 23 14:17 UTC
CVE-2026-114356Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with... Executive summary DJI CrystalSky ZS600C tablets running firmware v0.3.9.7 through v0.6.6.9 on Android contain a flaw that lets any locally installed app with no special permissions perform privileged system actions. The advisory rates it High, with a CVSS-style score of 7.0, and notes the device is end-of-life and unsupported. The advisory does not state a vendor fix or patch. Technical summary The flaw is missing authorization (CWE-862) in the system-privileged DJIUpdateService binder, whose onTransact() method performs no caller-identity or permission check. A local application with no permissions can call transactions 101 and 123 (clock and timezone change), 105 (shutdown), 153 (factory reset with user-data wipe), and 151 (firmware-apply hand-off). Affected firmware is stated as v0.3.9.7 through v0.6.6.9, described as the last release. The advisory does not state a fixed version, a workaround, or any mitigation for the end-of-life device. It reports non-destructive verification in which code 101 changed the system clock. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114356 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X Affects DJI DJI CrystalSky ZS600C NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.6	CVE-2026-114355	OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process... DJIDJI CrystalSky ZS600C	NVD	Oct 23 14:17 UTC
CVE-2026-114355OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process... Executive summary A local flaw in the DJI CrystalSky ZS600C tablet firmware, versions v0.3.9.7 through v0.6.6.9, lets a program already running on the device run commands with root privileges. The advisory rates it High with a CVSS-style score of 8.6, and states that the device is end-of-life and unsupported, so no fixed release is stated. Technical summary This is an OS command injection flaw in the root-owned hardware_monitor helper on Android. The helper reads lines from logcat and passes a field from each line to a shell eval, and any process on the device can write to logcat, so a local unprivileged process can inject a command that the root helper runs. The affected range is firmware v0.3.9.7 through v0.6.6.9, with v0.6.6.9 described as the last release. The advisory states that the vendor has no fixed version and that the device is EOL/unsupported, so no patch is available. No workaround is stated, and no detection guidance is given. The advisory says the issue was verified on device with uid=0. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114355 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X Affects DJI DJI CrystalSky ZS600C NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.6	CVE-2026-114354	Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a... DJIDJI CrystalSky ZS600C	NVD	Oct 23 14:17 UTC
CVE-2026-114354Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a... Executive summary A flaw in DJI CrystalSky ZS600C tablet firmware, versions v0.3.9.7 through v0.6.6.9, lets any locally installed app with no permissions run commands with full system control. The advisory rates it High, with a score of 8.6. The advisory states the device is end-of-life and unsupported, so no vendor fix is described; it is not stated whether any fix or workaround exists. Technical summary This is a missing authorization flaw in the native binder service 'android.dji.server' (transaction code 1018), which runs under a root-privileged assistant daemon. The transaction passes a caller-supplied string directly to system() without checking the caller's identity or permissions. Any locally installed application with zero permissions can trigger it and run arbitrary OS commands as root, and the advisory says this was verified from a permissionless APK with uid=0. Affected firmware is v0.3.9.7 through v0.6.6.9, described as the last release. No fixed version, workaround, or detection guidance is stated, and the advisory notes the device is EOL/unsupported. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114354 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X Affects DJI DJI CrystalSky ZS600C NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	7.0	CVE-2026-114353	Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a... DJIDJI CrystalSky ZS600C	NVD	Oct 23 14:17 UTC
CVE-2026-114353Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a... Executive summary The DJI CrystalSky ZS600C tablet, running firmware v0.3.9.7 through v0.6.6.9, contains a hidden backdoor that lets someone with physical USB access run commands on the device as the system administrator without logging in. The advisory rates the severity as High, with a score of 7.0. The advisory states the device is end-of-life and unsupported, so no vendor fix is stated; the only stated recommendation is that the device is no longer supported. Technical summary The flaw is an undocumented backdoor, classed as hidden functionality, in the root-privileged 'assistant' daemon. The daemon listens on the USB-gadget serial port /dev/ttyGS0 and, after receiving the hard-coded string dji26656677, passes each following line to system() as root. The attack requires physical USB access and no authentication. Affected firmware is stated as v0.3.9.7 through v0.6.6.9, which the advisory describes as the last release. A fixed version is not stated because the device is end-of-life. A workaround is not stated, and no detection guidance is provided. The advisory reports the issue was verified on the device with uid=0. The CVSS vector and any exploitation in the wild are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cyber-defence-campus.github.io/projects…ties/CVE-2026-114353 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Physical Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X Affects DJI DJI CrystalSky ZS600C NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-10632	A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages... ZimbraZimbra Collaboration Suite	NVD	Oct 23 14:17 UTC
CVE-2026-10632A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages... Executive summary The advisory covers a Zimbra Collaboration Suite (ZCS) reflected cross-site scripting flaw in the Classic Web Client, tracked as CVE-2026-10632, which lets an attacker inject JavaScript through the packages parameter. The text presents the flaw as a reflected XSS issue but does not state a severity rating for it. The advisory does not state a specific vendor recommendation for CVE-2026-10632, though the surrounding Zimbra page recommends updating to the latest release. Technical summary The flaw is a reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite, triggered through the packages parameter. The advisory does not state the attack vector details, user interaction requirements, or whether authentication is needed. Affected versions are not stated for CVE-2026-10632, and no fixed version is listed for it in the text provided. No CVSS score, workaround, exploitation status, or detection guidance is stated for this CVE. The text is a truncated NVD summary, and the surrounding Zimbra advisory table lists many other fixes with fix releases such as 10.1.21, but these are not explicitly tied to CVE-2026-10632. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.zimbra.com/wiki/Zimbra_Security_Advisories Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Affects Zimbra Zimbra Collaboration Suite NIST National Vulnerability DatabasePublished Oct 23, 2026 14:17 UTC Read the advisory
	High	8.1	RHSA-2026:88693	php security update Red Hat, PHPRed Hat Enterprise Linux, PHP, Red Hat Enterprise Linux Server - Extended Life Cycle Support 7	Red Hat Security Advisories	Oct 23 13:54 UTC
RHSA-2026:88693CVE-2026-109619php security update Executive summary Red Hat has released a security update for the PHP scripting language on Red Hat Enterprise Linux 7 Extended Lifecycle Support systems. The advisory rates the flaw Important, a use-after-free issue in PHP's fatal error handling. Red Hat recommends applying the updated php packages. Technical summary The flaw is tracked as CVE-2026-109619 and is described as a use-after-free caused by fatal error handling that retains stale request state in PHP. The advisory does not state the attack vector, required preconditions, or whether it is exploited in the wild. Fixed package version is php-5.4.16-48.el7_9.1 for the listed RHEL 7 ELS architectures (x86_64, s390x, ppc64, ppc64le). The advisory does not state a CVSS score, workarounds, or detection guidance beyond referring to the CVE page and the update article at https://access.redhat.com/articles/11258. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88693 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 Red Hat Product SecurityPublished Oct 23, 2026 13:54 UTC Read the advisory
	High	7.8	RHSA-2026:88687	kernel security update Red Hat, Linux kernelRed Hat Enterprise Linux, Red Hat Enterprise Linux 10.0 Extended Update Support, Linux kernel	Red Hat Security Advisories	Oct 23 13:49 UTC
RHSA-2026:88687CVE-2025-68745CVE-2026-23199CVE-2026-52972CVE-2026-638315 morekernel security update Executive summary Red Hat has released a kernel security update for Red Hat Enterprise Linux 10.0 Extended Update Support, rated Important by Red Hat. The update fixes several Linux kernel flaws, including denial of service and privilege escalation issues. The advisory points to the CVE links for CVSS scores and further detail, and the update is the vendor's recommended fix. Technical summary The advisory lists about eleven kernel vulnerabilities across subsystems, including a denial of service in the qla2xxx SCSI driver, a use-after-free in the ALSA timer that the advisory says allows privilege escalation, an out-of-bounds sense-data read in qla2xxx, and a use-after-free in strparser. Other fixes cover crypto af_alg AEAD length capping, mac802154 in-place crypto, netfs, nvmet-auth, procfs, usx2y, and SELinux TCP Fast Open checks. Attack vector, preconditions, and exploitation status are not stated in the advisory text. Affected and fixed kernel package versions are not stated here. Workarounds and detection guidance are not stated. Consult the CVE pages and the errata for the package versions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Red Hat Linux kernel Red Hat Enterprise Linux Red Hat Enterprise Linux 10.0 Extended Update Support Linux kernel Red Hat Product SecurityPublished Oct 23, 2026 13:49 UTC Read the advisory
	Medium	6.8	RHSA-2026:88563	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Mozilla ca-certificates	Red Hat Security Advisories	Oct 23 13:24 UTC
RHSA-2026:88563CVE-2026-114406ca-certificates security update Executive summary Red Hat published a critical security update for the ca-certificates package on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. The update distrusts eMudhra intermediate Certificate Authority certificates because of security concerns, and Red Hat recommends applying the updated package. The advisory does not state a CVSS score or whether the issue is being exploited. Technical summary The flaw is tracked as CVE-2026-114406 and concerns the ca-certificates trust store, which the advisory says should distrust eMudhra intermediate CA certificates due to security concerns. The advisory does not describe the vulnerability class, attack vector, or preconditions beyond this. The fixed package is ca-certificates-2026.2.92_v9.0.319-90.3.el9_6, and the advisory lists it for the affected Red Hat Enterprise Linux 9.6 variants across x86_64, s390x, ppc64le, and aarch64. The advisory does not state a CVSS score, workarounds, or detection guidance, and it refers readers to https://access.redhat.com/articles/11258 for how to apply the update. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88563 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Mozilla ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 13:24 UTC Read the advisory
	Unknown	n/a	CVE-2026-99087	In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99087In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the... Executive summary A flaw in the Linux kernel's dm-integrity device-mapper component causes a NULL pointer dereference (a crash) when a device with a dirty bitmap flag is activated in 'R' mode. The advisory describes this as a kernel fix in the stable tree; it does not state a severity rating. The fix is a kernel patch that skips writes to the device during resume when 'R' mode is used. Technical summary The vulnerability class is a NULL pointer dereference, leading to a crash in dm_integrity_resume when the SB_FLAG_DIRTY_BITMAP flag is set and the device is activated in 'R' mode. The advisory does not state the attack vector or required privileges. The fix adds a check for ic->mode == 'R' that skips superblock write operations during resume. Affected and fixed kernel version numbers are not stated in the advisory text provided. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2e25842f0e4423e…43f56153d842ed6b933f Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99086	In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the... LinuxLinux, Linux kernel, Linux dm-integrity	NVD	Oct 23 13:17 UTC
CVE-2026-99086In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the... Executive summary This advisory describes a fix in the Linux kernel's dm-integrity device-mapper driver, where the superblock could be altered on disk while the device was suspended and the driver would then resume using values that no longer matched its in-memory structures. The advisory does not state a severity rating or exploitation status. The fix makes the driver refuse to resume if the geometry-defining superblock fields changed, and the advisory points to a kernel stable tree commit as the remedy. Technical summary The flaw is an input validation issue (inconsistent state after superblock modification) in dm-integrity's resume path, which re-reads the superblock without validating it. According to the commit message, an increased log2_sectors_per_block can push a journal index past the end of the journal and cause a 512-byte write through lowmem_page_address(NULL). The precondition is that the superblock on the underlying device is modified while the dm-integrity device is suspended. The fix snapshots the validated superblock in the constructor and rejects resume when geometry fields change. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance beyond the commit diff. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/454b67fcc28c185…dfb9f067b04c28628ada Score No CVSS score published. Affects Linux Linux Linux kernel Linux dm-integrity NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99085	In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99085In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to... Executive summary A flaw in the Linux kernel's sched_ext scheduler can cause a CPU hotplug hang, where taking a CPU offline never finishes when that CPU's tasks are held by the BPF scheduler. The advisory does not state a severity rating or a CVSS score. The advisory describes a fix in the kernel but does not state any recommended action beyond the patch itself. Technical summary This is a hang (denial of service) caused by a logic error in the kernel's CPU hotplug handling for the sched_ext scheduler. A task on a user DSQ or held by the BPF scheduler stays counted on a dying CPU's run queue, so the hotplug thread is never woken and cpu_down() can block while holding cpu_hotplug_lock, or the offline stalls until the watchdog ejects the BPF scheduler. The fix re-enqueues tasks on a run queue going offline to the local DSQ and tests SCX_RQ_ONLINE so ops.dispatch() keeps running until the rq goes offline. The advisory does not state affected or fixed kernel versions, a CVSS score, a workaround, or any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99084	In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate_dir() takes the directory's i_rwsem shared... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99084In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate_dir() takes the directory's i_rwsem shared... Executive summary The advisory concerns the Linux kernel, specifically the readdir path for the directory of the nullfs instance used by empty and kernel thread mount namespaces. A user holding a directory read lock for a long time could block other users of that shared directory, stalling lookups, creates, and mounts. The advisory does not state a severity score, and it describes a fix that skips the lock for this directory type. Technical summary The flaw is a lock-ordering and availability problem: iterate_dir() holds the directory's i_rwsem shared across ->iterate_shared() even for directories that never change, so a reader stalled inside getdents() (for example, by a FUSE-backed user buffer that faults and waits) can block exclusive takers queued behind it. The advisory describes a local user triggering this on a shared nullfs directory, but it does not state a CVSS score or attack complexity. The described fix adds a FOP_IMMUTABLE flag to file operations for never-changing, never-removed directories and makes iterate_dir() skip the lock for them, applied to the nullfs directory. The advisory does not state affected or fixed kernel version numbers, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-99083	In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated... LinuxLinux, Linux kernel, Linux ksmbd	NVD	Oct 23 13:17 UTC
CVE-2026-99083In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated... Executive summary A heap out-of-bounds write in the Linux kernel's ksmbd SMB server component can be triggered when a Kerberos session setup request is part of a compounded SMB2 request. The advisory describes this as a memory corruption flaw in the kernel, and it does not state a severity score. The advisory describes a code fix to the kernel tree but does not state any specific mitigation for administrators. Technical summary The flaw is a heap out-of-bounds write (memory corruption) in krb5_authenticate() in fs/smb/server/smb2pdu.c. When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the out_len calculation omits work->next_smb2_rsp_hdr_off, so the length check passes and memcpy() can write the AP-REP blob past the end of response_buf. The advisory states the fix subtracts work->next_smb2_rsp_hdr_off when computing out_len. Affected and fixed kernel version numbers are not stated, and the advisory gives no CVSS score, exploitation status, or workaround. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/23a0be6a84a38ac…ab49017934e8e27c65f0 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel Linux ksmbd NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-99082	In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot... Linux, KVMLinux, Linux kernel, KVM	NVD	Oct 23 13:17 UTC
CVE-2026-99082In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot... Executive summary A flaw in the Linux kernel's KVM virtualization code for x86 processors could let a guest cause memory writes that bypass KVM's write tracking. The advisory does not give a severity score, and it says the fix is to use the vCPU's active memslots when caching MMIO entries. Technical summary This is an incorrect-resource-selection flaw in the KVM per-vCPU MMIO cache, where the fill and validation paths use address space 0 even when the vCPU runs in SMM and uses address space 1. A stale cache entry can remain valid after an SMM memslot update, so an access to valid RAM can be returned to userspace as KVM_EXIT_MMIO, and completing that exit can write a nested EPT backing page without write-tracking, risking stale shadow translations. The advisory names commits 56f17dd3fbc4 and 699023e23965 as background. The fix is to use active memslots (kvm_vcpu_memslots()) for caching and validation. Affected and fixed kernel versions, a CVSS score, workarounds, and exploitation status are not stated. Detection guidance is not stated beyond a WARN_ON_ONCE() in kvm_mmu_write_protect_fault() that the advisory says catches the invalid combination. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Linux KVM Linux Linux kernel KVM NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-99081	In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99081In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read... Executive summary The advisory describes a flaw in the Linux kernel's bnxt_en network driver, which supports Broadcom BCM57412 NetXtreme-E network cards. Small packets sent on VLAN or macvlan interfaces can cause the network card to read memory beyond the buffer it was given, leading to IOMMU DMA faults and transmit timeouts. The advisory does not state a severity rating, and it does not state a fix version or any vendor recommendation beyond the kernel patch described. Technical summary The weakness is a DMA mapping length error (buffer overrun during DMA read) in the bnxt_en driver's bnxt_start_xmit() function. Small frames shorter than BNXT_MIN_PKT_SIZE (52 bytes) are padded, but the DMA mapping and tracked length still use the original unpadded length, so the hardware reads 52 bytes from a 42-byte mapping, and a read near a 4KB page boundary faults in the IOMMU. The triggering condition described is transmitting small packets such as untagged ARP frames on VLAN or macvlan interfaces. The advisory states the fix as calling skb_put_padto(skb, BNXT_MIN_PKT_SIZE) before the fragment count is sampled. Affected and fixed kernel version numbers, a CVSS score, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Broadcom BCM57412 NetXtreme-E Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99080	In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear_inode() For many years we've had a hard to hit leak of xarray nodes LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99080In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear_inode() For many years we've had a hard to hit leak of xarray nodes Executive summary This advisory covers a fix in the Linux kernel's filesystem inode cleanup code, which had a long-standing memory leak of internal tree nodes that could be triggered through madvise. The advisory does not state a severity rating, and it describes this as a resolved kernel change rather than a documented attack. Technical summary The issue is a resource leak in the Linux kernel's clear_inode() function in fs/inode.c, where xarray nodes were left behind when radix tree expansion failed partway or when THP collapse_file() allocated temporary nodes without cleaning them up. The fix replaces the locked check with a call to xa_destroy() on the inode's i_pages, which frees excess nodes and cycles the i_pages lock, and adds a BUG_ON on nrpages. The advisory does not state a vulnerability class, attack vector beyond a note that syzbot and others found ways to trigger it with madvise, or any affected or fixed kernel version ranges. No workaround and no detection guidance are stated, and no CVSS score or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/21f51434c47d862…75ae6c6ad6b573abcd02 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-99079	In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails... Linux, MellanoxLinux, Linux kernel, Mellanox mlx5e	NVD	Oct 23 13:17 UTC
CVE-2026-99079In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails... Executive summary The advisory covers a Linux kernel fix in the mlx5e network driver for Mellanox ConnectX adapters, in its zero-copy AF_XDP receive path. A failed redirect and partial buffer refill could let a stale buffer pointer be freed again, which could publish the same packet buffer twice and corrupt receive data. The advisory describes the fix as marking the buffer as released immediately after it is freed so refill retries no longer free stale pointers; it does not state a severity rating. Technical summary The flaw is a use-after-release or double-publication condition in the legacy cyclic receive queue of the mlx5e driver when zero-copy AF_XDP buffers are used with XDP redirect. When the XSK receive ring is full, a partial batched refill can leave a WQE with a stale buffer pointer, which a later retry may free again after the buffer has been reallocated. The fix sets the SKIP_RELEASE flag right after the driver-side free, and the commit cites Fixes 3f93f82988bc. The advisory does not state affected or fixed kernel version numbers, a CVSS score, a workaround, or whether exploitation has been observed. It gives no detection guidance beyond noting that the failure is silent and produces no kernel warning. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/32bbb870078d467…5c21bbc4960c57eea208 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Linux Mellanox Linux Linux kernel Mellanox mlx5e NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-99078	In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99078In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e... Executive summary A flaw in the Linux kernel's mlx5e network driver for Mellanox ConnectX adapters can cause buffers to be released twice when AF_XDP zero-copy receive allocation fails and is retried. The advisory does not state a severity rating or a CVSS score. The fix is a kernel patch that the stable tree has merged, and the advisory does not describe any other vendor recommendation. Technical summary The vulnerability is a double free, or stale buffer release, in the Linux kernel net/mlx5e driver's AF_XDP striding receive queue path. When XSK buffer allocation returns -ENOMEM during a memory pool work queue element refill, a later NAPI poll retries the same WQE and can call xsk_buff_free() again through stale pointers. The fix sets all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). The advisory states the fix is in commit 63811edf512584c946e5e96b100e9e280703bbb5 and the Fixes tag names commit 4c2a13236807. The advisory does not state the affected or fixed kernel version numbers, the attack vector or required privileges, exploitation status, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3d73a1164a8c6b4…7a65cb6c022ea4fd39af Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.4	CVE-2026-99077	In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99077In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect... Executive summary The advisory covers a flaw in the Linux kernel's IPv4 UDP handling of ICMP Fragmentation Needed and Redirect messages. It allows off-path attackers to observe a cache and learn the ephemeral port of a connected UDP socket. The advisory states the fix is to always create the exception cache entry before socket matching; it does not state a severity rating or affected version ranges. Technical summary The weakness is a side-channel information leak in the IPv4 FIB nexthop exception (FNHE) cache, which lets an off-path attacker discover the ephemeral port of a connected UDP socket. The attack requires sending ICMP Fragmentation Needed or Redirect messages that quote a UDP packet, and the exception is only created when the quoted packet matches an existing socket. The fix always creates the exception by calling ipv4_update_pmtu() and ipv4_redirect() with an oif of 0. Affected and fixed kernel versions are not stated in the advisory, and no workaround, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99076	In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99076In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect... Executive summary The advisory concerns the Linux kernel's handling of ICMPv6 Packet Too Big and Redirect messages that quote UDP packets. An off-path attacker could use this to learn the ephemeral port of a connected UDP socket. The advisory does not state a severity rating, and it describes a fix that always creates an exception in the cache before socket matching. Technical summary The weakness is a side-channel information leak in the IPv6 exception cache, triggered when locally delivered ICMPv6 Packet Too Big or Redirect messages quote a UDP packet. Exceptions were previously created only when the quoted packet matched an existing socket, letting an off-path attacker observe the cache to infer the ephemeral port of a connected UDP socket. The fix always creates an exception by calling ip6_update_pmtu() and ip6_redirect() before socket matching, and passes the ingress ifindex and default uid. The advisory states that the fix adds an extra route lookup and may create two exceptions for the same destination in some cases. Affected and fixed kernel version numbers, CVSS score, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99075	In the Linux kernel, the following vulnerability has been resolved: rust_binder: reschedule node refcount update on thread exit When a thread exits via BINDER_THREAD_EXIT,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99075In the Linux kernel, the following vulnerability has been resolved: rust_binder: reschedule node refcount update on thread exit When a thread exits via BINDER_THREAD_EXIT,... Executive summary The advisory describes a flaw in the Linux kernel's rust_binder driver, which handles Android inter-process communication. When a thread exits, a pending node reference count update could be dropped, leaving a node that is never freed from a process's node tree. The advisory does not state a severity rating, and the fix is a kernel patch that reschedules the update so another thread delivers it. Technical summary The flaw is a logic error in the rust_binder driver where Node::cancel() and NodeWrapper::cancel() were no-ops, so a pending node refcount increment was dropped when a thread exited via BINDER_THREAD_EXIT. This desynchronizes delivery and count state and can prevent a node from being freed. The fix implements DeliverToRead::cancel() for Node and NodeWrapper to move the pending update to the process work queue. The advisory does not state the attack vector, required privileges, or exploitability, and it does not give a CVSS score. It does not list affected or fixed version numbers beyond the commit reference and the Fixes tag eafedbc7c050, and it gives no workaround or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2a74ccd1bcc170e…f34e9de8652b57e2cf3d Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99074	In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99074In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet... Executive summary A flaw in the Linux kernel's IPv4 route handling can crash the system through a null pointer dereference when a multipath nexthop group shrinks during a path MTU update. The advisory describes the replacement as requiring CAP_NET_ADMIN in the network namespace, which a local user may obtain where unprivileged user namespaces are allowed. The advisory does not state a severity score, and the fix is a two-line check in net/ipv4/route.c. Technical summary The vulnerability is a race condition that leads to a NULL pointer dereference (KASAN null-ptr-deref in update_or_create_fnhe) in the Linux kernel IPv4 PMTU update path. When a nexthop group is replaced by one with fewer members after the PMTU loop accepts an index, fib_info_nhc() returns NULL and the code dereferences it. The attack requires CAP_NET_ADMIN in the network namespace to replace the nexthop group, which a local user can gain in a new user and network namespace where unprivileged user namespaces are permitted. The fix adds a check that breaks out of the loop when the indexed path is absent, and the advisory states it is in commit 6619e01855e65ef35723685a557e3eb106f4ecf5. The advisory identifies the fixing commit as affecting the Fixes tag 7d3f3b4367f3 and says it is tagged for stable, but it does not state specific affected or fixed version numbers beyond a mention of v7.2 as the kernel where the oops was observed. A CVSS score, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/6619e01855e65ef…685a557e3eb106f4ecf5 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99073	In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99073In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to... Executive summary A flaw in the Linux kernel's IPv4 routing code can crash the system when a route dump runs at the same time as a nexthop group is replaced with a smaller one. The advisory does not state a severity rating or exploitation status. The advisory provides a kernel patch that stops the dump loop when the indexed path is missing, and it is shared through the Linux stable tree. Technical summary The flaw is a NULL pointer dereference in fib_dump_info_fnhe() in net/ipv4/route.c, a race between the RCU-protected IPv4 FIB dump and RTM_NEWNEXTHOP replacing a nexthop group with fewer paths. The loop bound comes from fib_info_num_path() while fib_info_nhc() reloads the group separately, so fib_info_nhc() can return NULL and the code dereferences it through nhc_flags. The fix adds a check that breaks out of the loop when nhc is NULL. The advisory does not state affected or fixed version numbers, a CVSS score, attack vector or privilege requirements beyond the race described, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/21cba134c30c17a…68b5809336437df5d7e6 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99072	In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99072In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit... Executive summary A fix in the Linux kernel's IPv4 routing code addresses a crash that can occur when a nexthop group shrinks during a route notification. The advisory does not state how severe the flaw is, and it does not give a CVSS score or say whether it is being exploited. The advisory names the Linux kernel stable tree as the affected product and points to the upstream fix commit. Technical summary The flaw is a NULL pointer dereference in the IPv4 route notification sizing function fib_nlmsg_size() in net/ipv4/fib_semantics.c. It occurs when an RTM_NEWNEXTHOP message replaces a nexthop group with fewer paths between two separate reads of the group, causing fib_info_nhc() to return NULL, which fib_nexthop_nlmsg_size() then dereferences. The advisory does not state the attack vector or privileges required. The fix adds a check that stops sizing when the indexed path is absent. The advisory does not give affected or fixed version numbers, and it does not state any workaround or detection guidance. The commit is marked for stable backport, and the advisory does not list specific kernel version ranges. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/72d9d17092bb37b…12042a0817d01a1f9e78 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99071	In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99071In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when... Executive summary A Linux kernel change removes a warning in the IPv4 routing code that could fire during a rare timing race when hardware flags on a route change. The advisory describes this as a fix to a false warning rather than a security flaw, and it does not state a severity rating. The recommended action is to apply the upstream kernel stable update that contains this change. Technical summary The advisory describes removing a WARN_ON in fib_alias_hw_flags_set() in net/ipv4/fib_trie.c that fired when fib_dump_info() returned -EMSGSIZE. The race occurs when nexthop compatibility mode is enabled and a concurrent replacement grows a nexthop group between the size calculation and the message fill, which happen under RCU only. The change keeps the existing error path, which frees the skb and reports the error to listeners. The advisory names commit 680aea08e78c as the fixed-by reference and gives the stable commit 088ba80eef85fa7a5ad8f9e7c82b403c99242b56, but it does not state affected or fixed kernel version numbers, a CVSS score, exploitation status, or any workaround. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/088ba80eef85fa7…f9e7c82b403c99242b56 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99070	In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99070In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with... Executive summary This advisory concerns a change to the Linux kernel's IPv6 routing code that removes a kernel warning triggered by a rare timing race. The advisory describes the change as a fix to a warning, not as a security vulnerability with a stated severity. The vendor-style recommendation is not stated in the text, beyond applying the stable kernel update that includes the commit. Technical summary The issue is a sizing race in fib6_info_hw_flags_set(), where the notification skb is sized with rt6_nlmsg_size() and filled later with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent group replacement can make rt6_fill_node() return -EMSGSIZE, which previously triggered a WARN_ON. The fix removes that warning while keeping the existing error path that frees the skb and reports the error. The advisory does not state a CVSS score, attack vector or required privileges, exploitation status, affected or fixed version numbers, workarounds, or detection guidance. The commit is marked for stable backport and references the Fixes tag 907eea486888. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/291fe0bafee78c9…e7f579f17793fd5a1e5a Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99069	In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99069In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and... Executive summary The advisory describes a flaw in the Linux kernel's ati_remote2 input driver, where device attribute handlers treat a USB interface device as a USB device. The advisory does not state a severity rating or an exploitation status. The fix is a kernel patch that changes the handlers to use the correct interface type, which is provided in the stable tree commit. Technical summary The weakness is a type confusion in the show and store callbacks for the channel_mask and mode_mask sysfs attributes in the ati_remote2 driver, which call to_usb_device() on a usb_interface device, producing an invalid pointer. The advisory does not state the attack vector, required privileges, or exploitation conditions. The fix replaces to_usb_device() and usb_ifnum_to_if() with to_usb_interface() in the attribute handlers, and the commit is tagged for stable backport. Affected and fixed kernel version numbers are not stated in the advisory text. No workaround and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2caae9d1977beea…4b3d86639262801fd116 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99068	In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d ("ALSA: ctxfi:... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99068In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d ("ALSA: ctxfi:... Executive summary A memory leak in the Linux kernel's ALSA ctxfi sound driver was fixed in a stable kernel update. The advisory describes it as a leak that occurs each time DAO input mappers are cleared, and it does not state a severity rating or any active exploitation. Technical summary The flaw is a memory leak (CWE class not stated) in the ALSA ctxfi driver, where dao_clear_input() removed mapper entries from a list and cleared their pointers without freeing the allocated array, so memory leaked on each call. The fix stores the base pointer of the allocation before clearing entries and frees it afterward, as shown in the included diff to sound/pci/ctxfi/ctdaio.c. The advisory does not state attack vector, preconditions, CVSS score, or the affected and fixed kernel version numbers beyond the referenced commits. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0919d8dd19f92e1…55c75fced9a454d644bf Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99067	In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() When paths_from_inode() fails,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99067In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() When paths_from_inode() fails,... Executive summary This advisory describes a reference leak in the Linux kernel's btrfs file system code, in the scrub warning routine that runs when the kernel reports corrupted files. The advisory does not state a severity rating or any effect beyond the leak itself. The fix, applied in the Linux kernel stable tree, releases a root reference on an error path that previously skipped it. Technical summary The flaw is a reference leak (a resource management bug) in fs/btrfs/scrub.c, function scrub_print_warning_inode(). When paths_from_inode() fails, the function jumped to its err label without dropping the reference taken by btrfs_get_fs_root(), so a root reference leaked each time path resolution failed while printing scrub warnings. The fix adds a btrfs_put_root(local_root) call on that failure path, consistent with the other paths of the function. The advisory does not state an attack vector, preconditions, a CVSS score, or whether the issue is exploitable beyond a resource leak. Affected and fixed version numbers are not stated in the text provided. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/12ba7d8b9cd45a2…f37c3f4b8a50422fb549 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99066	In the Linux kernel, the following vulnerability has been resolved: can: dev: init_can_skb(): restore skb header initialization Commit 9f10374bb024 ("can: remove private CAN... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99066In the Linux kernel, the following vulnerability has been resolved: can: dev: init_can_skb(): restore skb header initialization Commit 9f10374bb024 ("can: remove private CAN... Executive summary A fix has been committed to the Linux kernel's CAN networking code, where received CAN frame buffers were not properly initialized, which could let a machine crash. The advisory describes the issue as a kernel panic that takes down the whole machine, but it does not state a severity score or whether it is being exploited. Technical summary The flaw is an uninitialized header in socket buffers created by the CAN device layer (init_can_skb), introduced by commit 9f10374bb024 which removed the header reset calls. The mac_header is left at 0xFFFF, so when packet_rcv_spkt() handles a SOCK_PACKET socket, the push length calculation overflows and triggers skb_under_panic, leading to a kernel BUG and full machine panic. The advisory does not state the attack vector or what preconditions an attacker needs, such as whether local access or a specific socket type is required. The fix restores the skb_reset_mac_header, skb_reset_network_header and skb_reset_transport_header calls in init_can_skb. Affected and fixed kernel version numbers are not stated in the advisory text. No workaround and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0a04c0cb8606ff8…89d03ef255afe90d0d5f Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99065	In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() With commit 2125c0034c5d... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99065In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() With commit 2125c0034c5d... Executive summary A fix in the Linux kernel's cpuset code addresses a race during CPU hotplug (taking CPUs offline) that can cause a NULL pointer dereference. The advisory does not state a severity rating, and it describes the change as a fix for a kernel crash rather than a confirmed security exploit. Technical summary The flaw is a NULL pointer dereference in guarantee_active_cpus() in kernel/cgroup/cpuset.c, caused by a race between CPU hotplug offline processing and cpuset hotplug handling. During the window after cpu_active_mask is updated but before cpuset_handle_hotplug() updates the top cpuset's effective_cpus, the top cpuset may have no active CPU and the walk up the cpuset hierarchy can reach a NULL cs. The fix adds a NULL check that returns the filtered cpu_active_mask. The advisory states the bug was introduced by commit 7a0aabd9ce69 and references commit 2125c0034c5d, with the fix tagged for stable v6.16+. Attack vector, required privileges, and CVSS score are not stated. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/23b1ab15ca91f2c…49d9bb0fafeb700c7db2 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-99064	In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99064In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes... Executive summary The advisory describes a flaw in the Linux kernel's handling of CIPSO network options, where removing a CIPSO option leaves cached offsets for later IP options pointing at the wrong bytes. The advisory does not state how severe the flaw is, and it does not state a CVSS score. The advisory's fix is a kernel patch that adjusts those offsets, which is what the upstream stable tree carries. Technical summary The flaw is an incorrect offset adjustment in cipso_v4_skbuff_delattr(), which removes CIPSO bytes but does not update cached offsets for the srr, rr, ts and router_alert options that follow them. Consumers such as ip_forward_options() and __ip_options_echo() can then read the wrong bytes, and the advisory notes the latter may interpret packet data as an option length and copy it into fixed-size storage, which suggests a memory-safety impact, though a specific impact class is not explicitly stated. The advisory does not state the attack vector or preconditions beyond the description of the code path. Affected and fixed version ranges are not stated in the advisory. No workaround and no detection guidance are stated. The advisory gives the upstream commit 2200fe1d6148b78e1b8f00f4b2bd47760015077f and the fix adds four conditional offset subtractions in net/ipv4/cipso_ipv4.c. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2200fe1d6148b78…00f4b2bd47760015077f Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99063	In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99063In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so... Executive summary A flaw in the Linux kernel's device-mapper ioctl handling can cause the kernel to read a few bytes past the end of a buffer. The advisory says the out-of-bounds read can only be triggered by root, and it is not described as a security bug. The fix is a kernel stable tree patch that clamps the data start offset to the buffer size. Technical summary The flaw is an out-of-bounds read in the dm ioctl code, where get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without checking the actual buffer size, so a minimal buffer can leave data_start seven bytes past the end. The advisory shows a KASAN slab-out-of-bounds report triggered by a DM_LIST_DEVICES call with data_size set to 305. The attack precondition is local root access, and the advisory states the issue is not a security bug. The patch clamps data_start to param_size and sets the length to zero in that case. The advisory does not state a CVSS score, a workaround, or any detection guidance, and it does not state exploitation in the wild. Fixed versions beyond the referenced upstream commit are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/5680b6fb3054677…5d3baba24b649f1b430e Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99062	In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read_skb() After a partial stream receive, rx_bytes tracks the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99062In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read_skb() After a partial stream receive, rx_bytes tracks the... Executive summary A flaw in the Linux kernel's VSOCK virtio transport could leave socket receive accounting incorrect after a partial stream read. The advisory describes it as a counter underflow that can make sockets report the wrong readable state, but it does not state a severity score or exploitation status. The fix is a kernel patch in the stable tree, and the advisory does not state any other recommended action. Technical summary The flaw is an accounting error in virtio_transport_read_skb() in the Linux kernel VSOCK virtio transport, where rx_bytes was decremented by the full packet length after a partial stream receive, causing an underflow. The advisory says that on a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read from a 100-byte packet made SIOCINQ report -40, recv return ELOOP, and poll report the socket readable, and that after verdict detach the counter could hide queued bytes. The fix subtracts only skb->len minus the VSOCK offset from rx_bytes and retains the full packet length for buf_used and peer credit, referenced to commit a463f55c791b96cfd12df8b10ea737d45c80bb18 and Fixes tag 45ca7e9f0730. The advisory does not state a CVSS score, a CVE-specific list of fixed kernel versions, a workaround, or exploitation in the wild, and it gives no detection guidance beyond the patch itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/38bad3930b1185d…db3dd342ddc123c6f3ef Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99061	In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99061In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user... Executive summary A race condition in the Linux kernel's Broadcom brcmfmac Wi-Fi driver can crash the system when the driver is removed while a user space program such as wpa_supplicant is still exiting. The advisory describes this as a kernel crash (oops) triggered during driver removal. The advisory does not state a severity score, and it does not say whether the fix has been released or which kernel versions contain it. Technical summary The flaw is a race condition, described as a double removal of the P2P device interface in brcmf_detach(), which leads to a use-after-free style fault on a LIST_POISON2 value and a kernel oops. The preconditions are that wpa_supplicant has created a P2P device and the driver is removed while that process is still exiting; the advisory gives a reproduction using kill and rmmod on a CYW55513 board over SDIO. The fix described takes RTNL and the wiphy mutex in brcmf_detach() before reading the interface list and removes the P2P interface with locked=true. The advisory does not state affected or fixed version numbers for mainline, does not give a CVSS score, does not describe a workaround, and does not provide detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Broadcom brcmfmac Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99060	In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for... Linux, MediaTek, Inc.Linux, Linux kernel, MediaTek, Inc. MT7603	NVD	Oct 23 13:17 UTC
CVE-2026-99060In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for... Executive summary A flaw in the Linux kernel's driver for MediaTek MT7603 wireless chips can cause a crash when frames are injected through a monitor interface. The advisory describes it as a NULL pointer dereference fixed by initializing a global station entry before it is used. The advisory does not state a severity score, and the fix is a kernel stable tree patch that users should apply through their kernel updates. Technical summary The vulnerability is a NULL pointer dereference caused by an uninitialized sk_buff_head in the mt7603 driver's driver-private global station WCID. The advisory says the first frame injected through a monitor interface reaches __skb_queue_tail() with an uninitialized queue, which was made reachable by commit 0335c034e726. The fix calls mt76_wcid_init() on the global WCID in mt7603_mac_init() in drivers/net/wireless/mediatek/mt76/mt7603/init.c. The advisory does not state a CVSS score, an attack vector beyond local injection through a monitor interface, affected or fixed kernel version numbers, workarounds, or exploitation status. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/19d6fa087dcf242…5828b8282d4040bad168 Score No CVSS score published. Affects Linux MediaTek, Inc.Linux Linux kernel MediaTek, Inc. MT7603 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.7	CVE-2026-99059	In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing... Linux, WireGuardLinux, Linux kernel, WireGuard	NVD	Oct 23 13:17 UTC
CVE-2026-99059In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing... Executive summary A race condition in the Linux kernel's WireGuard VPN code could, in theory, let a second handshake session be derived from the same state after a concurrent handshake initiation. The advisory describes this as very unlikely to be hit in practice, and the fix adds a check to prevent it. Technical summary The flaw is a race condition (time-of-check to time-of-use) in the WireGuard noise handshake code, where a handshake response can be consumed after an intermediate handshake initiation has reset the state. The attack vector and preconditions beyond concurrent processing of a duplicated response message are not stated. The fix compares the ephemeral private key on the stack with the peer's latest handshake state before accepting the response. Affected kernel versions and fixed versions are not stated, and no workaround is described. No CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L Affects Linux WireGuard Linux Linux kernel WireGuard NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99058	In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99058In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that... Executive summary A bug in the Linux kernel's workqueue code can cause a NULL pointer dereference, which crashes the kernel when a kernel worker thread reaches a specific path while queueing work on a draining or destroying workqueue. The advisory does not state a severity score or whether the flaw is exploitable by an attacker. The fix is a one-line change that checks for a NULL pointer before it is used, and the advisory points to the upstream stable kernel commit as the remedy. Technical summary The flaw is a NULL pointer dereference (a kernel crash class) in the workqueue chained-work check. The function current_wq_worker() can return a worker whose current_pwq field is NULL, because that field is only set while a work function is running, and the is_chained_work() check can then fault before emitting its intended warning. The advisory describes the trigger as queueing on a draining or destroying workqueue; no attack vector, privilege requirement, or CVSS score is stated. The fix adds a check that worker->current_pwq is non-NULL before dereferencing it, and the fixed kernel version numbers are not stated beyond the commit identifiers in the advisory. No workaround and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1a2668682e99803…796b236319b380078a6a Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99057	In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than... Linux, XenLinux, Linux kernel, Xen netfront	NVD	Oct 23 13:17 UTC
CVE-2026-99057In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than... Executive summary A bug in the Linux kernel's Xen network frontend driver (netfront) can leak memory when a received packet has more fragments than fit in its buffer. The advisory does not state a severity score or how an attacker could trigger it, and the fix is a kernel patch that the stable tree has applied. Technical summary The flaw is a resource leak (memory leak) in the xen/netfront driver. When xennet_fill_frags() fails because a response chain has more slots than the skb's frags can hold, xennet_poll() takes its error path, but the skb was already removed from the temporary queue and was never freed, so the skb and its attached pages leak for each overflowing chain. The advisory says the backend decides how many slots it sends, which suggests a backend-driven trigger, but it does not state an explicit attack vector or privileges required. The fix puts the skb back on tmpq before the error path, and it is tagged Fixes ad4f15dc2c70 and Cc stable. The advisory does not state a CVSS score, affected or fixed kernel version numbers, workarounds, or any detection guidance, and it does not say whether exploitation has occurred. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/086944c1c2cbb68…c3ff08637847b03c8009 Score No CVSS score published. Affects Linux Xen Linux Linux kernel Xen netfront NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99056	In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above... LinuxLinux, Linux kernel, Linux strparser, Linux espintcp	NVD	Oct 23 13:17 UTC
CVE-2026-99056In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above... Executive summary The advisory describes a race condition in the Linux kernel strparser stream parser code, which could lead to a use-after-free when the parser is torn down while a receive call is still running. The advisory notes that a public reproducer exists that turns the issue into an exploit, and it does not state a severity score. The fix is a kernel patch; the advisory does not state affected or fixed version ranges beyond the referenced commit. Technical summary The flaw is a race condition, described as a possible use-after-free, between strp_recv() running in softirq or socket-locked context and strp_done() tearing down the parser. The race requires that strp_stop() is called without guaranteeing in-flight strp_recv() calls have finished before strp_done() runs; the advisory says only espintcp can be affected. The fix adds a lock_sock/release_sock pair in strp_done() to synchronize with pending strp_recv(), changes the stopped, paused, aborted, interrupted and unrecov_intr bitfields to u8 fields, and updates documentation to say the socket lock must not be held when calling strp_done(). The advisory does not state affected or fixed kernel version numbers, a CVSS score, workarounds, or detection guidance beyond the patch itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0984ebc631792ac…105112ee74a6b8f1efcc Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel Linux strparser Linux espintcp NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99055	In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable prefix,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99055In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable prefix,... Executive summary The advisory describes a flaw in the Linux kernel's TCP zerocopy receive code that can crash the system when an unreadable network fragment is handled. The advisory does not state a severity rating or CVSS score. The fix is a kernel patch that rejects these fragments before they are processed, and the advisory points to the stable kernel tree commit as the remedy. Technical summary The flaw is a NULL pointer dereference (CWE class not stated) in the Linux kernel TCP zerocopy receive path, where can_map_frag() dereferences a net_iov fragment that skb_frag_page() reports as NULL, leading to a kernel panic when panic_on_warn is set. The advisory says the trigger is a connected TCP socket receiving readable bytes followed by an unreadable DMABUF or IOURING net_iov fragment, and it notes that hardware reachability was not tested and requires CONFIG_NET_DEVMEM and a DMA-buf-bound RX queue. The fix adds a skb_frag_is_net_iov() check in can_map_frag() that returns false before skb_frag_page() is called, and the fix is identified by commit 1c7463ac0e99cc91c4eecc1b69a740ef1a619932 in the stable tree. Affected and fixed kernel version numbers are not stated, and no workaround is stated. Detection guidance is not stated beyond the KASAN report described in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1c7463ac0e99cc9…cc1b69a740ef1a619932 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99054	In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99054In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber... Executive summary The advisory describes a race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) topology server that can crash or destabilize the system during teardown. The affected component is the Linux kernel, and the advisory points to a stable-tree commit that fixes it. The advisory does not state a severity rating, and the fix is a kernel patch that the vendor-side stable tree has already committed. Technical summary The flaw is a race condition during shutdown of the TIPC topology server (tipc_topsrv_stop), where connections were closed while send and receive workqueues were still running, leading to refcount underflow, use-after-free, queue_work on a destroyed workqueue, and an RCU stall. The advisory states the fix: clear srv->listener under idr_lock as a shutdown flag, skip queue_work when it is NULL, destroy workqueues before closing remaining connections, refuse tipc_conn_lookup after the flag is cleared, and drop the lock when the teardown walk finds no connection. Attack vector and required privileges are not stated. Affected kernel versions and fixed version numbers are not stated beyond the commit referenced. No workarounds or detection guidance are stated, and no CVSS score or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0af8780bdfdfc91…7bddb9c48fab67dc9d9e Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99053	In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99053In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping... Executive summary A flaw in the Linux kernel's TIPC networking code can let a local or network-reachable handler use a node object after it has been freed, which can crash the system or otherwise corrupt memory. The advisory does not state a severity score or whether it has been exploited. The advisory describes a fix that takes a reference to the node before use, and it does not state any other vendor recommendation. Technical summary This is a use-after-free (CWE class not stated) in the TIPC protocol code of the Linux kernel, where tipc_node_find_by_name() returns a node pointer after leaving its RCU read-side section without taking a reference, so a concurrent timer-driven cleanup of a down peer can free the node while the LINK_SET, LINK_GET or LINK_RESET_STATS generic netlink handlers still use it. KASAN on v7.3-rc5 reported a slab-use-after-free in tipc_nl_node_set_link. The fix acquires a reference with kref_get_unless_zero() before leaving RCU, returns NULL if the node is already released, and releases the reference on every exit path, including after transmission in LINK_SET. Attack vector and privileges required are not stated, and affected and fixed version ranges are not stated in the advisory. No workaround and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99052	In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99052In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem... Executive summary A Linux kernel SELinux bug can cause a second mount of an NFSv4 filesystem exported with security_label to silently disable per-file labeling for both the new and the original mount. The advisory does not state a severity rating, and it describes a fix committed to the kernel tree rather than a security exploit. The fix is a kernel patch to the SELinux mount option handling; the advisory does not describe any workaround. Technical summary The flaw is a logic error in selinux_set_mnt_opts in security/selinux/hooks.c, where the early-exit paths for an already-initialized superblock did not set SECURITY_LSM_NATIVE_LABELS. When an NFSv4 filesystem with security_label is mounted again, the shared nfs_server loses NFS_CAP_SECURITY_LABEL, disabling per-file labeling. The advisory describes the trigger as a second mount of such a filesystem and does not describe a remote attack vector or privilege requirement. The patch adds the flag on both SE_SBINITIALIZED early exits when the superblock uses SECURITY_FS_USE_NATIVE. Affected kernel versions and CVSS score are not stated in the advisory text provided, and no workaround or detection guidance is given. The fixed version is not stated; the commit is identified only by hash 28b7260548af3d35773477993ad4e4de41578dd7. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/28b7260548af3d3…77993ad4e4de41578dd7 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99051	In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99051In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls... Executive summary The advisory describes a use-after-free bug in the Linux kernel's fs-verity code, which handles verified file integrity data. The advisory does not state how severe the issue is or whether it has a CVSS score. The fix is a kernel patch that delays freeing a data structure until it is safe, and the advisory points to the upstream stable tree commit as the fix. Technical summary The flaw is a use-after-free in fsverity, where __fsverity_get_info() can read a struct fsverity_info that has been freed while a concurrent lookup for a different inode is traversing the same rhashtable chain under rcu_read_lock(). The fix RCU-delays freeing of struct fsverity_info after removal from the hash table, using call_rcu() in fsverity_remove_info(). The advisory names the bug as introduced by commit f77f281b6118 and marked for stable backport, but it does not state affected or fixed kernel version numbers, attack vector or required privileges, a workaround, exploitation status, or detection guidance. Those points are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/e58c3805ed325fe…2dd467c0486cc860b733 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99050	In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99050In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before... Executive summary The advisory describes a race condition in the Linux kernel's GPIO MPSSE driver, which handles USB-attached GPIO adapters. A timing window during IRQ worker setup can lead to a use-after-free when the device is disconnected. The advisory does not state a severity score, and the fix is a patch committed to the Linux kernel stable tree. Technical summary The flaw is a race condition in gpio_mpsse_irq_enable() where the poll worker is scheduled before being added to the priv->workers list, so a concurrent gpio_mpsse_disconnect() can miss it and the driver data can be freed while the worker still accesses it, causing a use-after-free. The fix publishes and arms the worker within one irq_spin critical section, adds a priv->dying flag checked before publishing, and uses kfree_rcu() on the dying path. The advisory does not state a CVSS score, attack vector details beyond the disconnect timing, or whether exploitation has occurred. It does not state affected or fixed kernel version numbers, and it gives no workaround or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/76390ac0bca7e50…82eb4d951c3bda5df812 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99049	In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99049In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter... Executive summary This advisory describes a resolved bug in the Linux kernel's Xilinx GPIO driver, where a failed request left a power-management reference held, so the GPIO controller could not power down and kept its clock running. The advisory does not state a severity rating, and it does not describe any attack or exploitation. The fix is a kernel patch that is already merged into the stable tree, and the advisory does not state any further recommended action beyond applying that patch. Technical summary This is a resource leak (reference counting error) in the gpio-xilinx driver: pm_runtime_get_sync() increments the usage counter even on failure, and xgpio_request() returned the error without dropping it, so xgpio_free() never ran to release it. The consequence stated is that the controller can no longer runtime-suspend and its clock stays enabled. The fix replaces the call with pm_runtime_resume_and_get(), which only increments the counter on success, and the change is listed as touching drivers/gpio/gpio-xilinx.c. The advisory names commit 26b04774621e as the introducing change and 2fd6ecda5d1f47cffcfadddb35ee49402162c724 as the fixing commit. The advisory does not state a CVSS score, attack vector, privileges required, exploitation status, affected kernel version ranges, fixed kernel version numbers, or workarounds. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2fd6ecda5d1f47c…dddb35ee49402162c724 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99048	In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls... Linux, GoogleLinux, Linux kernel, Google gve	NVD	Oct 23 13:17 UTC
CVE-2026-99048In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls... Executive summary The advisory describes a flaw in the Linux kernel's gve driver, which is the network driver for Google virtual NICs. When XSK pools are disabled, the driver can deadlock on a lock it already holds, so the affected system can hang in that path. The advisory does not state a severity rating, and the fix is a kernel patch that changes the driver to use the locked NAPI disable and enable calls. Technical summary The flaw is a deadlock, a locking bug, in the gve_xsk_pool_disable path of the Linux kernel gve driver. The driver called the unlocked versions of napi_disable and napi_enable even though the netdev lock was already held because gve supports queue management ops, so the thread tried to re-acquire a lock it already held. The advisory says the issue was found in production. The fix replaces the calls with napi_disable_locked and napi_enable_locked, in commit 0cb6939a4dfefa822007b7a71986e06bc4f61f54, and the fixed kernel version is not stated in the advisory. The advisory does not state the CVSS score, attack vector or required privileges, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0cb6939a4dfefa8…b7a71986e06bc4f61f54 Score No CVSS score published. Affects Linux Google Linux Linux kernel Google gve NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99047	In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as... Linux, GoogleLinux, Linux kernel, Google gve	NVD	Oct 23 13:17 UTC
CVE-2026-99047In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as... Executive summary A flaw in the Linux kernel's gve network driver, which is used with Google Virtual NIC hardware, causes buffers used for AF_XDP zero-copy to leak when receive rings are stopped. The advisory does not state a severity score or describe an attack, but it says the issue was hit in production. The fix is a kernel patch that frees these buffers when rings are stopped, and the advisory presents it as a stable tree commit. Technical summary This is a resource leak (buffer leak) in the gve driver's DQO receive path for AF_XDP zero-copy buffers. When ring state is reset during queue stop, XSK buffers posted to the NIC were not freed, so they leaked. The fix frees XSK buffers attached to an allocated buf_state in gve_rx_reset_ring_dqo and clears the pointer. The commit is tagged Fixes c1fffc5d66a7 and Cc stable. The advisory does not state affected or fixed kernel version numbers, a CVSS score, attack vector or required privileges, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/506f9de069d07a7…7ce3edd2fdf32f4953aa Score No CVSS score published. Affects Linux Google Linux Linux kernel Google gve NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-99046	In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor,... Linux, GoogleLinux, Linux kernel, Google gve	NVD	Oct 23 13:17 UTC
CVE-2026-99046In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor,... Executive summary The advisory concerns a resource leak in the Linux kernel's gve network driver, which is used with Google virtual network hardware. The leak affects AF_XDP zero-copy receive buffers when a receive completion descriptor reports an error. The advisory does not state a severity rating, and the fix is a kernel patch that the stable tree has already incorporated. Technical summary This is a buffer leak (resource management flaw) in the gve driver's DQO RX datapath for AF_XDP zero-copy. When the rx_error bit is set in the RX completion descriptor, the driver freed the buf_state but did not free the attached XSK buffer, so the XSK buffer leaked. The fix, shown in the diff, checks whether buf_state->xsk_buff is set and, if so, calls xsk_buff_free() and gve_free_buf_state() instead of gve_free_buffer(). The advisory references the commit that introduced the bug as c1fffc5d66a7 and the fixing commit 06656aaa7e43ae62b673c2244d27099b8b94a70d, and says the fix is tagged for stable. Affected and fixed kernel version ranges, attack vector and preconditions, workarounds, and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/06656aaa7e43ae6…c2244d27099b8b94a70d Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Linux Google Linux Linux kernel Google gve NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99045	In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then... Linux, IBMLinux, Linux kernel, ibmveth	NVD	Oct 23 13:17 UTC
CVE-2026-99045In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then... Executive summary This advisory describes a resolved bug in the Linux kernel's ibmveth network driver, which is used for IBM virtual Ethernet adapters. The advisory does not state how serious the flaw is or whether it can be exploited. The fix moves a hypervisor deregistration call so the driver cleans up correctly when opening the interface fails. Technical summary The flaw is in the ibmveth driver's open path, where the logical LAN was registered with the hypervisor but not deregistered when a buffer pool allocation failed, so the hypervisor still owned the buffer-list page when it was unmapped. The advisory describes this as a resource cleanup error rather than a stated memory corruption or privilege escalation issue. The attack vector, preconditions, and CVSS score are not stated. The fix moves the h_free_logical_lan call to the shared unwind label so both failure paths deregister first, and it references commit af0524bf4ce1a4cbd2946aa81751582951cfcab5 and a Fixes tag for commit d43732ce021f. Affected and fixed kernel version ranges are not stated in the advisory text. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/a065bd31ec462f6…7026b708dd020f122723 Score No CVSS score published. Affects Linux IBM Linux Linux kernel ibmveth NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99044	In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to... Linux, IntelLinux, Linux kernel, Intel ice	NVD	Oct 23 13:17 UTC
CVE-2026-99044In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to... Executive summary A use-after-free bug was fixed in the Linux kernel's Intel ice network driver, in the code that cleans up dynamic ports. The advisory describes the fix as reordering two cleanup steps so the driver no longer reads memory after it has been freed. The advisory does not state a severity rating, and it does not describe any workaround beyond applying the kernel fix. Technical summary The flaw is a use-after-free in ice_dealloc_dynamic_port(), where the driver freed the VSI before reading its index to erase the dynamic port from pf->dyn_ports. The fix moves the xa_erase call ahead of ice_vsi_free, following the reverse of the allocation order. The advisory names the commit that fixes it and lists the fixed-in kernel version only as the commit itself; no affected or fixed kernel version range is stated. Attack vector, required privileges, and exploitability are not stated, and no CVSS score is given. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1402fc67d2f4e2e…f8ee0825b8ad994557ff Score No CVSS score published. Affects Linux Intel Linux Linux kernel Intel ice NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99043	In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses... Linux, IntelLinux, Linux kernel, Intel ice	NVD	Oct 23 13:17 UTC
CVE-2026-99043In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses... Executive summary The advisory describes a flaw in the Linux kernel's Intel ice network driver, specifically in how it releases metadata objects when a virtual port representor is torn down. The advisory does not state a severity rating, and it describes the change as a reference-counting fix that the kernel stable tree has applied. Technical summary The flaw is a reference-counting error in the ice driver's representor teardown path, where metadata_dst_free() frees the object without checking its dst_entry refcount, so the object can be freed while packets still hold references, such as packets queued in a qdisc on the lower device. The fix replaces metadata_dst_free() with dst_release() in ice_eswitch_release_repr(), and the diff shows this change in ice_eswitch_release_reprs() in drivers/net/ethernet/intel/ice/ice_eswitch.c. The advisory states the fix is tagged for stable and references the upstream commit 58858b8f14803a7eeac297b3ce20f3b21bf2ff66, but it does not state the affected or fixed kernel version numbers, a CVSS score, a workaround, exploitation status, or the attack vector beyond the queued-packet precondition. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1f263235651775f…d90c9f25c3f4a4ef6512 Score No CVSS score published. Affects Linux Intel Linux Linux kernel Intel ice NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.4	CVE-2026-99042	In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills... LinuxLinux, Linux kernel, Linux io_uring	NVD	Oct 23 13:17 UTC
CVE-2026-99042In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills... Executive summary A flaw in the Linux kernel's io_uring connect filter lets certain IPv6 connection attempts bypass filters that block IPv6 ports or addresses. The advisory says the filter sees zero port and address values while the kernel connects to the real destination. The advisory presents the fix as a stable-tree patch, but it does not state a severity rating or a CVSS score. Technical summary The weakness is a logic error in io_connect_bpf_populate(), where the filter fields connect.port and connect.v6_addr are populated only when addr_len is at least sizeof(struct sockaddr_in6), which is 28 bytes. The IPv6 stack accepts 24-byte addresses (SIN6_LEN_RFC2133), so a connect issued with addr_len 24 is seen by the filter as port and address zero while the real destination is contacted, bypassing port or address denial rules. The attacker precondition is a local ability to issue IORING_OP_CONNECT under a filter, and the advisory does not describe a remote vector. The fix changes the threshold to SIN6_LEN_RFC2133 in io_uring/net.c, and the advisory says the code is present in 7.2 and the fix is tagged for stable 7.2. Affected version ranges, fixed version numbers beyond the commit reference, CVSS data, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/596a955d2d01b7e…ed60ebcf7c4ba518b8e5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affects Linux Linux Linux kernel Linux io_uring NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99041	In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99041In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to... Executive summary A flaw in the Linux kernel's IPv6 ERSPAN tunnel code can cause a NULL pointer dereference when a crafted tc tunnel_key and mirred redirect path is used. The advisory describes this as a kernel panic, and the advisory does not state a severity score. The fix removes an obsolete PMTU update block, and the advisory presents that removal as the resolution. Technical summary The vulnerability is a NULL pointer dereference in ip6erspan_tunnel_xmit() in net/ipv6/ip6_gre.c, where a legacy PMTU update treats a METADATA_IP_TUNNEL dst as a route and dereferences a NULL output device, leading to a kernel panic. The advisory describes a local, unprivileged trigger using self-created user and network namespaces together with a tc tunnel_key action and mirred redirect to a native ip6erspan device. The fix is a commit that removes the stale ERSPAN PMTU block and its unused dst variable, with the upstream commit ID 8bc60db48e8cba35488bbd6e1f94aa990afa275a. The advisory does not state affected or fixed kernel version ranges beyond the mention of v7.2 in the KASAN reproduction, does not state a CVSS score, does not state any workaround, and does not state detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2d06cb25a497d3a…f9d172626c2d6620a0f1 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99040	In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99040In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots... Executive summary A race condition in the Linux kernel's keyring code can let a user with write permission on a keyring add a key even when the keyring owner has installed a reject-all restriction. The advisory does not state a severity rating. The advisory's fix is a kernel code change that moves a restriction check so it runs after the keyring lock is taken; the advisory does not describe any other recommended action. Technical summary This is a race condition (time-of-check to time-of-use) in the Linux kernel KEYS subsystem, in __key_create_or_update() in security/keys/key.c. The restrict_link pointer was read before the destination keyring's semaphore was taken, so a writer could use a stale NULL snapshot after a reject-all restriction was installed. The advisory states the attacker only needs write permission on the destination keyring. The fix moves the restrict_link read after __key_link_lock() and __key_link_begin(). The advisory names commit 5ac7eace2d00 as the introducing commit and the fixed commit as 11516a0c402a6c1fa52254aa70d8d65fb921e59e. Affected and fixed kernel version ranges are not stated beyond a reproduction on v7.2.8. CVSS score, workarounds, and exploitation in the wild are not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/11516a0c402a6c1…54aa70d8d65fb921e59e Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99039	In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick_alloc_card() and... LinuxLinux, Linux kernel, Linux memstick	NVD	Oct 23 13:17 UTC
CVE-2026-99039In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick_alloc_card() and... Executive summary A flaw in the Linux kernel's memstick subsystem can cause memory corruption when a memory stick device is being identified and the request times out. The advisory describes this as a use-after-free bug that can be triggered by a delayed USB transfer or command retry. The advisory does not state a severity score, and the fix it describes is to wait for the in-flight request to complete rather than freeing the card early. Technical summary The vulnerability is a use-after-free (CWE class not stated, but described as a KASAN slab-use-after-free write) in the Linux kernel memstick core. In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_completion_timeout() can expire while a host controller driver such as rtsx_usb_ms still runs the request, after which the card structure is freed and the driver later writes into it. The advisory does not state a CVSS score or attack vector details beyond a delayed USB transfer or command retry as a trigger. The fixed version is not stated. The advisory states the fix is to replace wait_for_completion_timeout() with wait_for_completion() in memstick_set_rw_addr() and memstick_alloc_card(). No workarounds or detection guidance are stated, and whether the issue has been exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel Linux memstick NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99038	In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them memstick_check() can pass... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99038In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them memstick_check() can pass... Executive summary A flaw in the Linux kernel's driver for Realtek RTSX USB memory stick readers could cause the system to hang when a memory card reader is removed. The advisory describes it as a kernel bug fix where requests were silently dropped during removal, and the fix makes those requests complete instead. The advisory does not state a severity rating, and it does not describe any recommended action beyond the code change. Technical summary The flaw is a request-handling race in the memstick rtsx_usb_ms driver, where a request sent just before device removal is silently dropped and never completed, causing blocked kernel tasks and a hang in memstick_check and memstick_remove_host. The trigger is a device eject or removal occurring while memstick_check is issuing a request, so local physical or hardware-event conditions are implied, but no attack vector is stated. The advisory describes the fix: requests are always scheduled and failed with -ENOMEDIUM after eject, handle_req is flushed rather than cancelled, and the host_mutex drain is removed. Affected and fixed kernel versions are not stated, and no CVSS score, workaround, or detection guidance is given. The advisory text provided is also duplicated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99037	In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the... LinuxLinux, Linux kernel, Linux dm-crypt	NVD	Oct 23 13:17 UTC
CVE-2026-99037In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the... Executive summary The advisory describes a flaw in the Linux kernel's dm-crypt device-mapper component. A crafted table line pairing an AEAD cipher with the lmk IV mode causes a kernel oops when loaded, and the advisory states it can only be triggered by root. The advisory does not state a severity score, and the fix is a kernel commit that rejects this combination. Technical summary The flaw is a memory corruption issue in dm-crypt: setting tfms_count to 64 for the lmk IV mode while only one AEAD transform is allocated causes crypt_setkey to read past the end of the tfms_aead array and call crypto_aead_setkey on invalid values. The attack requires local root to load a capi: table line such as capi:gcm(aes)-lmk with the integrity:28:aead option, and the advisory states it is not a security bug for that reason. The fix adds a check in crypt_ctr_cipher_new that rejects lmk with AEAD ciphers, and the advisory references the commit 3195e0daf590683992edb4eed32269e569e04924. Affected kernel versions and fixed release versions are not stated in the advisory. No workaround beyond the patch is stated, and no detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3195e0daf590683…b4eed32269e569e04924 Score No CVSS score published. Affects Linux Linux Linux kernel Linux dm-crypt NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99036	In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99036In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done... Executive summary This advisory concerns a race condition in the Linux kernel device-mapper driver, in the do_resume path that handles table reloads. The advisory states that it is not a security bug because only root can trigger it, and the vendor patch fixes the race condition. Technical summary The flaw is a race condition in the device-mapper ioctl handler do_resume, where dm_table_get_mode(new_map) is called without locks, so a concurrent ioctl that swaps the table can cause a read of freed memory. The advisory says it was found by syzbot and that only root can trigger it. The fix reads the new table's mode before dm_swap_table, as shown in the patch diff in drivers/md/dm-ioctl.c. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance beyond the patch itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/281f68d6cf8acb2…f0a849b8beae8fb0ec3c Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99035	In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99035In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is... Executive summary A use-after-free flaw in the Linux kernel's MediaTek MMC/SD host driver (mtk-sd) can occur when the driver is unbound or removed while a request timeout callback is still running. The advisory does not state a severity rating or an exploitation status. The fix described is to cancel the request timeout work synchronously during driver removal, and the advisory presents this as a kernel patch in the stable tree. Technical summary The vulnerability class is a use-after-free (CWE not stated). The flaw is in msdc_drv_remove() in drivers/mmc/host/mtk-sd.c: cancel_delayed_work() does not wait for a running req_timeout callback, which can keep using host structures after the managed mmc_host is freed during unbind. KASAN reported use-after-free accesses in msdc_request_done() and msdc_recheck_sdio_irq() in three unbind tests. The attack vector and required privileges are not stated, and the advisory does not describe a remote or unprivileged trigger. The fix adds cancel_delayed_work_sync(&host->req_timeout) after mmc_remove_host(). Affected and fixed kernel version numbers are not stated in the advisory text, and no workaround or detection guidance is given beyond the patch. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/46e75703ca3f00f…5b3ce35b90836e34e8af Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99034	In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while... LinuxLinux, Linux kernel, Linux sdhci-sprd	NVD	Oct 23 13:17 UTC
CVE-2026-99034In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while... Executive summary A fix has been applied to the Linux kernel's sdhci-sprd MMC/SD host controller driver, which handles storage card interfaces on Spreadtrum-based systems. The advisory describes a resource handling error that can leave clocks in an inconsistent state when the driver is removed while the device is runtime suspended. The advisory does not state a severity rating, and the change is delivered as a stable-tree kernel patch. Technical summary The flaw is a runtime power management cleanup error in the sdhci_sprd_remove() function. The probe path enables runtime PM but the normal remove path disables clocks that runtime PM callbacks also manage, so clocks may already be disabled if the device is runtime suspended. The fix resumes the device, disables runtime PM, and drops the temporary reference before disabling clocks. The advisory says the issue was found by manual code inspection and tagged it for stable backport, with the Fixes tag referencing commit fb8bd90f83c4. Affected and fixed kernel version numbers are not stated, and the attack vector, preconditions for exploitation, and CVSS score are not stated. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/03244b8713d0444…dbee08037ecd79b684f9 Score No CVSS score published. Affects Linux Linux Linux kernel Linux sdhci-sprd NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99033	In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99033In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header... Executive summary A flaw in the Linux kernel's packet socket receive path can crash a system. A local user with the CAP_NET_RAW capability who opens a SOCK_PACKET socket bound to a CAN interface can trigger a full kernel panic from received frames. The advisory does not state a severity score, and it describes the fix as a guard in the kernel code. Technical summary The issue is a missing device header check in packet_rcv_spkt(), which calls skb_push() using a mac header offset that can be the 0xFFFF sentinel on devices such as CAN interfaces that do not set mac headers. The result is a negative length passed to skb_push(), which triggers skb_under_panic() and a kernel panic from softirq context. The advisory says the socket type is reachable through packet_create() behind a CAP_NET_RAW check. The fix wraps the push in dev_has_header(), matching the other two receive paths. No fixed kernel version is stated, and no workaround or detection guidance is stated. The advisory notes that the missing skb_reset_*_header() calls in init_can_skb() are being fixed separately. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99032	In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99032In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without... Executive summary A flaw in the Linux kernel's SMC (Shared Memory Communications) networking code can cause a use-after-free or NULL pointer dereference when a getsockname() call races with the release of the underlying CLC socket. The advisory does not state a severity rating or CVSS score. The fix serializes access to the CLC socket during the getname check, and the advisory does not describe any other vendor recommendation. Technical summary The vulnerability is a race condition leading to use-after-free (or NULL dereference) in smc_getname(), where smc->clcsock is accessed without holding clcsock_release_lock while a link-group termination worker may release the CLC socket. The advisory states it can be triggered after shutdown(SHUT_WR) while the SMC socket remains open, and KASAN output is shown from test-only timing instrumentation. The fix holds clcsock_release_lock across the pointer check and getname() callback and returns -EBADF if the CLC socket was already released. Affected kernel versions, fixed versions, workarounds, and exploitation status are not stated in the advisory. No detection guidance is provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99031	In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99031In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes... Executive summary This advisory describes a fix in the Linux kernel's network bridge multicast code. The flaw could let a large number of multicast exclude-port entries exhaust kernel stack memory, which the advisory frames as a crash risk. The advisory does not state a severity score, and the recommended action is to apply the kernel stable tree patch. Technical summary The weakness is recursive cleanup in the bridge multicast code: br_multicast_sg_del_exclude_ports() calls br_multicast_del_pg(), which calls back into the same helper for S,G entries, so each STAR_EXCL port consumes a stack frame and can reach the stack guard page. The fix splits the deletion path so the S,G exclude-port cleanup is suppressed while that helper is already walking the entry, and the fix is referenced to commit 5158353121bae4f552cb677ce8c5c3ef52f93a0d and a Fixes tag for commit 8266a0491e92. The advisory does not state the attack vector, required privileges, or whether it is remotely triggerable. Affected and fixed kernel version numbers are not stated, and no workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2fb87c6025f9019…ee3ce14b42eb3e1cfed7 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-99030	In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99030In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches... Executive summary A flaw in the Linux kernel's network buffer code could cause stale memory contents to be sent out on the network in some packets. The advisory does not state a severity score, and it describes the fix as a change that zeroes unfilled buffer space when unreadable fragments are encountered. The fix is delivered as a stable kernel tree patch, and the advisory does not describe any other vendor recommendation. Technical summary The issue is an information exposure: when skb_copy_and_csum_bits() hits unreadable fragments it returns 0 after copying only the linear part, leaving the rest of the caller's buffer uninitialized, so stale memory can be transmitted in an ICMP error quoting a packet or in a driver TX bounce buffer. The advisory states the fix zeroes the unfilled portion of the buffer for positive lengths only, and it names the commit that introduced the bug as 65249feb6b3d. The advisory does not state affected or fixed kernel version numbers, the CVSS score, attack vector details beyond the described conditions, or whether exploitation has been observed. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/39d1a6b60183123…8b5e3ac8dbb883c1700a Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99029	In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct... Linux, MicrochipLinux, Linux kernel, Microchip sparx5	NVD	Oct 23 13:17 UTC
CVE-2026-99029In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct... Executive summary A memory leak in the Linux kernel's Microchip Sparx5 network driver causes memory to be lost each time a matchall traffic filter is deleted. The advisory does not state a severity rating, and the fix is a one-line code change in the stable kernel tree that frees the entry after it is removed from the list. Technical summary This is a memory leak (CWE class not stated) in the sparx5 matchall traffic control code of the Linux kernel. sparx5_tc_matchall_destroy() unlinks each sparx5_mall_entry from sparx5->mall_entries but never frees it, so every deleted mirror or goto matchall filter leaks memory. The advisory does not state the attack vector, privileges required, or any exploitation impact beyond the leak. The fix adds a kfree(entry) call after list_del() in drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c, referenced by commit 2b82e16d6084cbc651e3c902198f1945408ee1a5. Affected and fixed kernel version numbers are not stated in the advisory. No workaround, CVSS score, or exploitation status is stated. Detection guidance is limited to kmemleak reporting the leak, which the advisory says no longer occurs with the fix. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2b82e16d6084cbc…c902198f1945408ee1a5 Score No CVSS score published. Affects Linux Microchip Linux Linux kernel Microchip sparx5 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99028	In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99028In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver... Executive summary This advisory covers a fix in the Linux kernel's Xilinx AXI Ethernet (axienet) network driver. When the interface is brought down, the driver could leak memory buffers and their DMA mappings, which can eventually exhaust a limited IOMMU address space; the advisory does not state a severity rating. The advisory describes the upstream patch that resolves the issue and does not state any action beyond applying that kernel fix. Technical summary The flaw is a resource leak (memory and DMA mapping) in the dmaengine path of the axienet driver: on ndo_stop, terminated descriptors never ran their completion callbacks, so the SKBs still owned by the engine were not freed or unmapped on each ifdown. A race between the RX completion callback re-arming the ring and axienet_stop() could also leave a buffer armed after teardown; the patch adds a rx_submit_lock and a stopping flag to fence this. The attack vector, attacker preconditions, and CVSS score are not stated. The advisory states the fix is in upstream patch bcf2573a68a808a5b54cadafa72b6672e662c2bf and the stable commit 079396129da5e7cb40ca0920aa1b9525bef6097c, but affected and fixed version ranges are not stated in the text. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/079396129da5e7c…0920aa1b9525bef6097c Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99027	In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99027In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return... Executive summary This advisory covers a flaw in the Linux kernel's team network driver, where a packet buffer could be reused after it had already been freed, which the advisory says can cause a KASAN use-after-free report and a kernel panic. The advisory does not state a severity score, and the vendor-style fix is a kernel patch that stops the driver from reusing the buffer after handing it to a queue override port. Technical summary The vulnerability class is use-after-free in the team driver's queue override transmit path (drivers/net/team/team_core.c), where a nonzero dev_queue_xmit() result was treated as if the skb was still owned by the driver. The advisory describes a KASAN slab-use-after-free triggered by a qdisc drop, and it notes that the kernel panics when panic_on_warn is set. The fix limits the override to the first port under RCU and returns without retrying, and the commit is tagged for stable and cites Fixes 8ff5105a2b9d. The advisory does not state the attack vector or required privileges, does not give affected or fixed version ranges beyond the commit references, does not state a CVSS score, does not describe workarounds, and does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/07a48cfceb3d055…9acb87c949500a7b4523 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99026	In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99026In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the... Executive summary The advisory describes a flaw in the Linux kernel's team network driver, in its broadcast mode, where a packet buffer can be kept after a transmit attempt when no usable port exists. The advisory does not state a severity rating or a CVSS score. The vendor-side fix is a kernel patch that frees the packet buffer on that path, and the advisory does not state any workaround. Technical summary The weakness is a resource handling error (a buffer not freed, leading to retained socket write-memory charge) in the team driver's broadcast transmit function bc_transmit() in drivers/net/team/team_mode_broadcast.c. When no port is transmit-enabled, bc_transmit() returns false without consuming the skb, while team_xmit() still returns NETDEV_TX_OK, so AF_PACKET senders keep the skb. The advisory says this can occur with a TX-enabled link-down port, or with a carrier held up by a second link-up TX-disabled port or forced on by userspace. The fix adds dev_kfree_skb_any(skb) on the no-port path, referenced to commit 5fc889911a99 and tagged for stable. Affected and fixed kernel version ranges are not stated in the advisory text, and no workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Linux team driver Summarized from git.kernel.org/stable/c/489114c9ecae44e…1a4b3e610ee5ebd9189c Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99025	In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99025In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand... Executive summary A flaw in the Linux kernel's Open vSwitch netlink flow dump code can cause a soft lockup and kernel panic on a busy compute node with many datapath flows. The advisory describes the problem as a kernel fix that holds bottom-half interrupts off during the flow dump callback. The advisory does not state a severity score or any exploitation in the wild. Technical summary The issue is a soft lockup (a denial of service class condition) in the openvswitch netlink flow dump path, where ovs_flow_cmd_dump() repeatedly releases stats->lock with spin_unlock_bh() for each CPU that touched a flow, and each release runs pending softirq work in the dumping thread. The advisory describes this as triggered on a production node with a few thousand datapath flows under heavy packet load, with voluntary preemption preventing the thread from being descheduled. The fix described is to disable bottom halves across the whole callback, similar to ctnetlink_dump_table(), at the cost of preemption under CONFIG_PREEMPT outside PREEMPT_RT. The advisory does not state affected or fixed version numbers, a CVSS score, a workaround, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Open vSwitch openvswitch Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99024	In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called tee_device_register() on both... Linux, OP-TEELinux, Linux kernel, OP-TEE driver	NVD	Oct 23 13:17 UTC
CVE-2026-99024In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called tee_device_register() on both... Executive summary The advisory describes a flaw in the Linux kernel's OP-TEE trusted execution driver, where TEE devices were registered before the driver was fully set up, so user space or kernel code could use them during initialization. The advisory does not state a severity rating, and it does not describe any attack in the wild. The fix is a kernel code change that moves device registration to the end of driver setup, and the advisory does not mention any separate workaround. Technical summary The weakness is a race condition, where tee_device_register() ran before struct optee was initialized, leaving mutexes, completions, the RPMB mutex, the message argument cache and the context pointer uninitialized, which can lead to use of uninitialized locks and a NULL pointer dereference. The advisory says the devices are reachable from user space via tee_open() and from kernel space via tee_client_open_context() during this window, but it does not state the required privileges or any other preconditions. The fix moves both tee_device_register() calls in optee_probe (smc_abi.c) and optee_ffa_probe (ffa_abi.c) to after initialization, with matching error label changes. The advisory does not state affected or fixed version numbers, a CVSS score, or any workaround, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/262062c01f5a817…8bf6eacb7c6ffdc7018d Score No CVSS score published. Affects Linux OP-TEE Linux Linux kernel OP-TEE driver NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99023	In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() of_regulator_bulk_get_all()... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99023In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() of_regulator_bulk_get_all()... Executive summary The advisory covers a memory leak in the Linux kernel's PCIe M.2 power sequencing driver, where an allocated array was never freed. The advisory does not state how severe the issue is, and the fix is a two-line change that frees the array on driver error and removal paths. Technical summary The flaw is a memory leak (resource management error) in drivers/power/sequencing/pwrseq-pcie-m2.c, where the consumers array allocated by of_regulator_bulk_get_all() was never freed. The advisory does not state an attack vector, privileges required, or whether the leak can be triggered remotely or by an unprivileged user. The fix adds kfree(ctx->regs) in the probe error path (err_free_regulators) and in pwrseq_pcie_m2_remove, and the commit is tagged for stable backport with a Fixes reference to commit 52e7b5bd62ba. Affected and fixed kernel version numbers are not stated in the advisory. No workaround, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0d6c5794fd63342…ad8b51d94061295649da Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99022	In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99022In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are... Executive summary A Linux kernel fix in the regulator driver for the LTC3676 power management chip stops a plain register dump from resetting the board. Reading the write-only HRST and CLIRQ registers triggered a hard reset, and the advisory describes this as a reboot of the board. The advisory does not state a severity rating, and it describes a kernel patch rather than a remote attack. Technical summary The flaw is an incorrect register access permission in the ltc3676 regulator driver: the write-only HRST (0x1e) and CLIRQ (0x1f) registers were treated as readable, so reading them fires the command. A debugfs register dump such as cat /sys/kernel/debug/regmap/2-003c/registers can trigger a hard reset of the chip and reboot the board. The fix splits the callback into separate writable and readable checks so HRST and CLIRQ remain writable but are not readable. Affected and fixed kernel version numbers are not stated in the advisory text, and the advisory does not give a CVSS score, a workaround, or exploitation details. Detection guidance is not stated beyond the commit itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/199a62d70314d21…a6faaa3ef54d0404910c Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99021	In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of_regulator_bulk_get_all() of_regulator_bulk_get_all() returns an... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99021In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of_regulator_bulk_get_all() of_regulator_bulk_get_all() returns an... Executive summary This advisory covers a fix in the Linux kernel regulator code, where a function that builds arrays of power regulator handles could leave supply names unset and could copy names without a length bound. The advisory does not state a severity rating, and it describes the change as a fix for a bug that could cause a crash or read uninitialised memory on one code path. The advisory does not state any specific vendor recommendation beyond applying the upstream stable tree change. Technical summary The advisory describes a kernel fix in of_regulator_bulk_get_all() in drivers/regulator/of_regulator.c. The function returned a bulk array where the supply name field was not set, so regulator_bulk_enable() could dereference uninitialised memory when printing a failed supply name. The fix allocates the names in the same allocation as the array and removes a fixed 64 byte stack buffer whose copy was not bounded. The advisory names the fixing commit 82ac8c4939bdbd064b4f54a580fbe4baf0d60e41 and the Fixes tag 27b9ecc7a9ba, but does not state affected or fixed kernel version numbers, attack vector, required privileges, exploitability, a CVSS score, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/82ac8c4939bdbd0…54a580fbe4baf0d60e41 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99020	In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99020In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4... Executive summary A bug in the Linux kernel's voltage regulator driver for TI TPS65224 power management chips (and TPS652G1, which uses the same descriptors) can cause the kernel to read past the end of an internal table. The advisory does not state a severity rating, and it does not describe any attack or exploitation. The fix replaces a hard-coded count with an automatic array size so the count matches the table. Technical summary The flaw is an out-of-bounds read in the tps6594-regulator driver, caused by the n_linear_ranges value for the BUCK2, BUCK3 and BUCK4 descriptors being set to 4 while the tps65224_bucks_2_3_4_ranges table has only two entries. It occurs on the normal registration path when the core checks voltage constraints for selectors above 0x45. The advisory does not state an attack vector, required privileges, or exploitability beyond this kernel path. The fix uses ARRAY_SIZE() for the count, and it is tagged for stable backport with Fixes reference 00c826525fba. The advisory does not state affected or fixed kernel version numbers, a workaround, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Texas Instruments TPS65224 Dropped extracted product not named in the source: Texas Instruments TPS652G1 Summarized from git.kernel.org/stable/c/1ea151615a82fd9…38b2cc7eeac49112508b Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99019	In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99019In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device... Executive summary A flaw in the Linux kernel's SCSI changer driver (ch) causes it to hold references to tape library data transfer drive devices that are never released. The advisory says this can leave removed drives stuck on the host, blocking new devices at the same address and preventing the driver module from being unloaded until a reboot. The advisory does not state a severity rating, and the fix is a kernel patch that releases the references. Technical summary This is a reference leak (resource management flaw) in the Linux kernel SCSI changer driver drivers/scsi/ch.c, in ch_readconfig(), which calls scsi_device_lookup() for each data transfer element and never drops the reference. The advisory says the leaked devices stay on the host device list, causing later scsi_device_get() failures and making the low-level driver module impossible to unload without a reboot. The attack vector, privilege requirements, and CVSS score are not stated, and the advisory does not describe exploitation in the wild. The fix is a commit that calls scsi_device_put() after printing the device name and removes the unused dt[] array; affected and fixed kernel version numbers are not stated in the advisory text. No workarounds or detection guidance beyond observing module use counts in lsmod are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1d35a17f1c2ed41…895694a1a3557f0da766 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99018	In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG_SHADOW_CALL_STACK,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99018In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG_SHADOW_CALL_STACK,... Executive summary The advisory describes a flaw in the Linux kernel's RISC-V trap entry code when the Shadow Call Stack option is enabled. A local user program could potentially make the kernel run with an attacker-chosen shadow call stack pointer, which the advisory describes as a kernel write and control-flow hijack primitive. The advisory does not state a severity score, and the provided text does not name a fixed version or a vendor-issued update, though the description shows a code fix was made. Technical summary The flaw is in handle_exception() on RISC-V under CONFIG_SHADOW_CALL_STACK, where the kernel decided whether a trap came from userspace by comparing the user-writable tp register against the current tp rather than using the hardware sstatus.SPP bit. A user task can set tp to the address of its own task_struct so the comparison succeeds, causing the kernel to skip reloading the shadow call stack pointer in gp, and the advisory says this can be achieved by brute force with KASLR enabled. The fix decides user-versus-kernel entry from sstatus.SPP, mirroring the check in ret_from_exception. The advisory does not state affected or fixed kernel version numbers, a CVSS score, a workaround, or detection guidance, and it does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.0	CVE-2026-99017	In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks... Linux, T-HeadLinux, Linux kernel, T-Head C9xx	NVD	Oct 23 13:17 UTC
CVE-2026-99017In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks... Executive summary A flaw in the Linux kernel's RISC-V errata handling for T-Head C9xx processors means a vulnerable CPU can be reported as not affected in kernels built without a certain option. The advisory describes the issue as one that leaves the default mitigation unapplied on affected hardware, but it does not state a severity rating. The fix is a one-line Kconfig change that makes the detection run early in boot, and the advisory points to a stable kernel tree commit as the remedy. Technical summary This is a logic and configuration flaw in the Linux kernel's T-Head Ghostwrite errata handling, where the vulnerable state is only recorded during the early boot alternatives stage. That stage runs only when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which was selected only by ERRATA_THEAD_MAE, so a kernel built with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n never applies the mitigation and sysfs reports "Not affected" on a vulnerable C9xx CPU. The attack vector, exploitation preconditions beyond this build configuration, and CVSS score are not stated. The fix selects RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE, and the advisory references commit 298510bbc7c3017c0faf481c6ea66f1065b657b4. Affected and fixed kernel version numbers are not stated, and no workarounds or detection guidance beyond checking the sysfs report are given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/298510bbc7c3017…481c6ea66f1065b657b4 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux T-Head Linux Linux kernel T-Head C9xx NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99016	In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99016In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but... Executive summary A flaw in the Linux kernel's RISC-V futex code lets a local user with tagged pointers reach kernel memory they should not be able to change. The advisory describes it as allowing an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel addresses under certain configurations. The advisory does not state a severity score, and the fix is a kernel patch that untags the user pointer before the atomic operation. Technical summary The vulnerability is a pointer-tagging mismatch in the RISC-V futex helpers: access_ok() validates the untagged address, but the inline assembly atomics use the raw tagged address, so a tagged pointer can name a canonical kernel address. It requires the tagged address ABI to be enabled (CONFIG_RISCV_ISA_SUPM with PR_SET_TAGGED_ADDR_CTRL and PMLEN nonzero), and the advisory gives Sv57 with PMLEN=16 as an example where tag bits overlap canonical address bits. The advisory describes an unprivileged attacker using FUTEX_WAKE_OP, with FUTEX_OP_CMP_* results as a read oracle. The fix adds uaddr = untagged_addr(uaddr) in arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic(), and the referenced commit is 2e5c80bbc062a8dda33e687ebf7be8f074ee4f7d. Affected kernel versions other than the fixed commit are not stated, and no workaround, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2e5c80bbc062a8d…687ebf7be8f074ee4f7d Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99015	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99015In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-device detachment Rebinding an HCI socket after its controller is... Executive summary A race condition in the Linux kernel Bluetooth HCI socket code can crash the kernel when a socket is rebound after its Bluetooth controller is unregistered. The advisory describes this as a kernel crash caused by a NULL pointer dereference or use-after-free. The advisory does not state a severity score, and the fix is a kernel patch that serializes the affected code path. Technical summary The flaw is a missing locking condition (race) in hci_sock_bind() in net/bluetooth/hci_sock.c, where the device pointer is cleared and the device reference dropped under only the socket lock while monitor control replay holds the list lock for reading, which can lead to a NULL pointer dereference or use-after-free. The advisory's KASAN trace shows a null-ptr-deref in create_monitor_ctrl_open. The fix takes hci_sk_list.lock for writing around the device pointer clearing and socket state reset. Affected and fixed version numbers are not stated as release versions; the advisory only gives kernel stable commit 37cef0c8fb537f40600910d2c2e5f2d5509305f3 and upstream commit 381a0925c556a8d91a80a9b9e3e86651d60ffee3. Attack vector, required privileges, and workarounds are not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/37cef0c8fb537f4…10d2c2e5f2d5509305f3 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99014	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync scan setup,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99014In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync scan setup,... Executive summary A flaw in the Linux kernel's Bluetooth stack can cause a use-after-free memory error during passive scan setup for Bluetooth Low Energy connections. The advisory does not state a severity score or whether it has been exploited, and it does not describe a vendor-recommended action beyond the kernel fix described. Technical summary The flaw is a use-after-free (slab-use-after-free) in the Bluetooth hci_sync code, where a pointer to a command buffer is used after the buffer may have been freed by the command worker running on a separate workqueue. The advisory describes a race between the scan worker and hci_cmd_work during PA sync scan setup, and it reports a KASAN trace. The advisory states the fix uses hdev->lock to serialize the address snapshot and skb replacement, and copies the address before releasing the lock. Affected and fixed kernel version numbers, CVSS score, required privileges, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99013	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99013In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before... Executive summary A race condition in the Linux kernel's Bluetooth ISO socket code can be triggered by two concurrent listen() calls on the same broadcast socket. The advisory describes it as a use-after-free that can lead to stale socket access, and it does not state a severity score. The advisory describes the fix as rejecting the competing listener setup, and it does not state any affected or fixed version numbers. Technical summary The flaw is a race condition, described with a KASAN slab-use-after-free report, in the Linux kernel Bluetooth ISO implementation (iso_sock_listen and iso_listen_bis). Two concurrent listen() calls on the same broadcast socket can both observe BT_BOUND, causing a second connection attachment that overwrites iso_pi(sk)->conn and leaks a reference, leaving a stale socket access after teardown. The fix rechecks BT_BOUND and requires iso_pi(sk)->conn to be NULL under both the HCI device and socket locks, returning -EBADFD on a competing setup. The advisory does not state affected kernel versions, fixed versions, CVSS score, or any workaround. Attack vector and required privileges are not stated, and no detection guidance is given beyond the KASAN trace. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99012	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso_sock_connect() checks the socket state before... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99012In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso_sock_connect() checks the socket state before... Executive summary A race condition in the Linux kernel Bluetooth ISO socket code can be triggered by concurrent connect calls, and the advisory describes it as a use-after-free that can lead to access of freed memory. The advisory does not state a severity rating or a CVSS score. The fix is a kernel change that serializes concurrent connect calls, and the advisory does not describe a separate workaround. Technical summary The flaw is a race in iso_sock_connect() in the Linux kernel Bluetooth ISO implementation, where the socket state is checked before the socket lock is taken and released before the connection is set up, allowing two callers to pass the check concurrently. The advisory describes resulting use-after-free conditions, with a KASAN report showing a slab-use-after-free in iso_sock_hold. The advisory says the fix serializes connect calls, rejects concurrent connects with -EBADFD, and rejects existing socket attachments in __iso_chan_add(). Attack vector and required privileges are not stated. Affected and fixed kernel version numbers are not stated. A workaround is not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.1	CVE-2026-99011	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() sco_recv_scodata() upgrades the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99011In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() sco_recv_scodata() upgrades the... Executive summary A flaw in the Linux kernel's Bluetooth SCO code can cause a use-after-free memory error when the Bluetooth receive path races with the release of a connection object. The advisory does not state how severe the issue is or whether it has been exploited, and it does not give a CVSS score. The advisory describes a kernel fix but does not state any affected or fixed version numbers. Technical summary The vulnerability is a race condition leading to a slab use-after-free in the Linux kernel Bluetooth SCO subsystem, in sco_recv_scodata() and sco_conn_free(). A weak hcon->sco_data pointer was upgraded to a reference without the lock that the clearing path did not hold, so the RX path could operate on freed memory, as shown by a KASAN report. The fix gives hcon->sco_data a real reference, clears it only in sco_conn_del() under hdev->lock, and moves hci_conn reference ownership to the socket. The advisory does not state affected or fixed kernel versions, workarounds, or any detection guidance, and it does not state whether an attacker can trigger the race remotely or what privileges are required. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99010	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99010In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to... Executive summary A memory leak in the Linux kernel's Bluetooth RFCOMM socket code can cause received data frames to be discarded without being freed, so memory use grows while a connected channel has no owner. The advisory does not state a severity rating. The fix is a kernel patch that frees the skb when the DLC has no owner, and the advisory points to the stable tree commit as the remedy. Technical summary The flaw is a resource leak (memory not freed) in rfcomm_sk_data_ready() in net/bluetooth/rfcomm/sock.c. When a connected DLC has no owner because rfcomm_sock_destruct() cleared it, incoming data frames are handed to the callback, which returns without freeing the skb, leaking one buffer per frame. The advisory says the leak keeps growing because the remote is never throttled and credits keep being granted. The fix adds kfree_skb(skb) before returning when there is no owner, and the advisory references the Fixes tag 1da177e4c3f4 and a stable commit 4f46de658ce61968aef5ea7ae809d1c180330544. Affected kernel versions and the fixed version number are not stated in the advisory. A CVSS score, attack vector details beyond a remote peer sending frames, workarounds, and exploitation status are not stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/4f46de658ce6196…ea7ae809d1c180330544 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99009	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM connect() issued while a... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99009In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM connect() issued while a... Executive summary A fix was made in the Linux kernel's Bluetooth RFCOMM code to remove a lock-ordering problem that could cause a circular locking dependency between rfcomm_mutex and hdev->lock. The advisory describes this as a kernel locking flaw triggered by an RFCOMM connect() during Bluetooth link authentication. The advisory does not state a severity score or a recommended action beyond the code change described. Technical summary The flaw is a lock-ordering inversion (AB/BA) between rfcomm_mutex and hdev->lock in the Linux kernel Bluetooth RFCOMM implementation, which lockdep reports as a possible circular dependency. The advisory describes the trigger as an RFCOMM connect() issued while a BR/EDR link is being authenticated or encrypted, with the connect not needing to succeed. The advisory does not state an attack vector beyond local or userspace triggering, a CVSS score, or the affected and fixed kernel versions. The fix connects the session socket without holding rfcomm_mutex and adds the session afterward, and it adds a RFCOMM_CLOSED mark to handle sockets closed during the window. The advisory does not state any workaround or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99008	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99008In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer... Executive summary A flaw in the Linux kernel's Bluetooth RFCOMM code can cause a NULL pointer dereference when an RFCOMM serial device is closed, which can crash the system. The advisory does not state a severity score, and the fix is a one-line change that adds a NULL check, which the advisory's source commit provides. Technical summary The weakness is a NULL pointer dereference in rfcomm_dev_shutdown() in net/bluetooth/rfcomm/tty.c. If device registration fails in rfcomm_dev_add(), dev->tty_dev is never set, but the device is already on rfcomm_dev_list, so an open() of /dev/rfcommN can attach to it and a later close triggers the fault. The advisory shows a KASAN null-ptr-deref and general protection fault. The fix adds a check for dev->tty_dev before it is used, matching the existing check in rfcomm_dev_destruct(). The advisory names the fix commit 08e90633377f1b2567ab5ad6810b74c552246a07 and cites a Fixes tag of cad348a17e17 and Cc to stable, but it does not state affected or fixed kernel version ranges, a CVSS score, a workaround, exploitation status, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/08e90633377f1b2…5ad6810b74c552246a07 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99007	In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99007In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on... Executive summary The advisory describes a flaw in the Linux kernel's direct rendering graphics helper (drm/fb-helper) that can leave a display framebuffer in an inconsistent state after a probe failure. The advisory shows the kernel fix that defers setup on any probe failure, which prevents a kernel warning triggered when the display state is restored, but it does not state a severity rating or exploitation status. Technical summary The flaw is a state-handling bug in the Linux kernel DRM fb-helper: when drm_fb_helper_single_fb_probe() fails with an error other than -EAGAIN, the framebuffer helper does not set deferred_setup, so a later restore call commits a mode_set with no framebuffer and hits a WARN_ON in __drm_atomic_helper_set_config(). The advisory's commit reproduces this via a syzbot report triggered on process exit through drm_lastclose(). The fix marks deferred_setup on any probe failure and keeps the real error code. The advisory does not state the attack vector or required privileges, affected or fixed kernel version numbers, a CVSS score, workarounds, or detection guidance beyond the patch itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3b303696f61461b…19d7fcac6a646652b2b4 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99006	In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call... Linux, IntelLinux, Linux kernel, Intel i915	NVD	Oct 23 13:17 UTC
CVE-2026-99006In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call... Executive summary A flaw in the Linux kernel's Intel i915 graphics driver can cause the kernel to free memory outside the intended buffer during command submission. The advisory text does not state a severity rating or real-world exploitation, and it describes this as a fix in the stable tree. Technical summary The flaw is in the drm/i915 GEM execbuffer code, where eb_relocate_parse_slow() can call kvfree() on entries beyond the original exec array because the cleanup path uses an incremented buffer_count that includes VMAs appended by the command parser, which is a memory safety (out-of-bounds) issue. The advisory does not state the attack vector, required privileges, or exploitation conditions. The fix changes the cleanup to use the original exec object count captured before VMAs are appended. Affected and fixed version numbers are not stated, though the commit is cherry-picked to stable and the Cc line references kernel 5.10+. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/152fb5083b9333a…29572f9e0f276a404ba6 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Intel Linux Linux kernel Intel i915 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99005	In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between... Linux, IntelLinux, Linux kernel, Intel i915	NVD	Oct 23 13:17 UTC
CVE-2026-99005In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between... Executive summary The advisory describes a fix in the Linux kernel's Intel i915 graphics driver, in the GT power management code. A race condition could cause the driver to touch hardware while the runtime power wakelock was not held, which the kernel reports and taints itself for. The advisory does not state a severity rating, and the fix is a kernel patch that skips an interrupt unmask when the GPU is no longer active. Technical summary The flaw is a race condition in the drm/i915 GT render power management code, where rps_work() could run after the GT was parked and unmask RPS PM interrupts without the runtime PM wakelock held. The advisory describes this as observed during the live_rc6_ctx_wa() selftest, and it does not describe a remote attack vector or required preconditions beyond the timing race. The fix skips the unmask when RPS is no longer active, and it is described as a cherry-picked commit ca4a6deadad15b91ee083afe445fa6bdbfb68206. Affected and fixed kernel version ranges are not stated in the advisory, and no workaround is stated. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Intel Linux Linux kernel Intel i915 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99004	In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination:... LinuxLinux, Linux kernel, Linux drm/imagination	NVD	Oct 23 13:17 UTC
CVE-2026-99004In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination:... Executive summary This advisory covers a fix in the Linux kernel's Imagination GPU driver (drm/imagination) that corrects how memory for page tables is reserved when mapping GPU memory. The flaw could make the driver reserve a huge number of page tables, exhausting system memory and triggering an out-of-memory panic. The advisory describes the fix as a kernel stable tree patch, and it does not state a severity score. Technical summary The flaw is an integer underflow and incorrect sizing in the page table preallocation logic of the pvr_mmu_op_context_create() function in the drm/imagination driver. When a mapping crossed a page table boundary, the difference between start and end indices could underflow, causing the driver to preallocate a very large number of MMU pages, which could exhaust memory and trigger an out-of-memory panic. The fix sizes the tables from the device address and the inclusive end of the range, and an exclusive end that allocated one table too many is also removed. The advisory does not state the attack vector, required privileges, or CVSS score. It does not state affected or fixed version numbers beyond the referenced commits, and it does not state any workaround or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/51b56bad96fd201…f660b337c00317c65151 Score No CVSS score published. Affects Linux Linux Linux kernel Linux drm/imagination NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99003	In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99003In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In... Executive summary A flaw in the Linux kernel's Arm Mali (Panthor) GPU graphics driver can be triggered by unprivileged userspace and may crash the system. The advisory describes it as a kernel crash caused by requesting more queues than the firmware initialized, and it does not state a severity score. The fix adds a check that rejects queue counts above the firmware's initialized slot count. Technical summary This is an out-of-bounds or uninitialized access flaw in the drm/panthor driver, where a queue count is validated only against the hardcoded MAX_CS_PER_CSG limit rather than the number of firmware stream interfaces actually initialized. An unprivileged user can request more queues than the firmware reported, causing cs_slot_prog_locked() to dereference an uninitialized stream interface and possibly crash. The fix adds a check in panthor_group_create() rejecting queues.count greater than sched->cs_slot_count with -EINVAL. The advisory does not state affected or fixed kernel version numbers, a CVSS score, or workarounds, and it gives no detection guidance. The commit references Fixes de8548813824 and is tagged for stable backport. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Arm Mali Panthor GPU driver Summarized from git.kernel.org/stable/c/4487cf79bf173f2…02d102076f8a20d23b96 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-99002	In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99002In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before... Executive summary This advisory covers a Linux kernel fix in the vmwgfx graphics driver, which handles VMware virtual GPU display support. The flaw could allow out-of-bounds memory reads when cursor snooping copies data from a surface, and the fix validates the pitch and box dimensions from userspace before copying. The advisory does not state a severity rating. Technical summary The vulnerability is an out-of-bounds read in the vmwgfx driver's cursor snooping routine, vmw_kms_cursor_snoop, caused by missing validation of the pitch and box dimensions supplied from userspace. The advisory does not state the attack vector or the privileges required to trigger it, though the commit describes it as a possible out-of-bounds read. The fix adds checks that reject zero-sized boxes and copies whose computed source extent exceeds the buffer size, and it corrects the destination stride and kmap page count. The fix is in the commit with ID 21bc51cb89ced74d6645a138cc2f21184bc75094 and the commit references the bug introduced by 2ac863719e51, but the advisory does not state affected or fixed kernel version numbers, workarounds, exploitation status, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/21bc51cb89ced74…a138cc2f21184bc75094 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99001	In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-99001In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in... Executive summary A flaw in the Linux kernel's Intel Xe graphics driver I2C support (drm/xe/i2c) can cause a use-after-free when the device is removed while a deferred work item is still pending or running. The advisory does not state a severity rating, exploitation status, or an attack vector. The advisory describes a fix that cancels the pending work during removal, which is the upstream kernel change the vendor recommends. Technical summary The weakness is a race and use-after-free in the Linux kernel drm/xe i2c teardown path: xe_i2c_remove() does not drain i2c->work, so a queued or running work item can dereference i2c->adapter after the adapter platform device is unregistered, or run after the devm-allocated struct xe_i2c has been freed. The fix moves bus_unregister_notifier() ahead of the client teardown loop and cancels the work immediately after it. Attack vector, required privileges, and preconditions are not stated. Affected and fixed version numbers are not stated in the advisory, and no workaround is stated. No detection guidance is stated; the advisory references a cherry-picked upstream commit, a23f27d5ec11c3f418c5e5531eea34ccda2b5b20. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99000	In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and... LinuxLinux, Linux kernel, Linux drm/xe	NVD	Oct 23 13:17 UTC
CVE-2026-99000In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and... Executive summary The advisory describes a flaw in the Linux kernel's Intel Xe graphics driver (drm/xe) where memory accounting for the shrinker can be subtracted or added twice when a buffer is pinned more than once. The advisory says this can cause the shrinker to run excessively under memory pressure. The advisory text provided is truncated, and it does not state a severity rating, a fixed version, or a vendor recommendation. Technical summary The weakness is an accounting error (double subtraction and underflow of signed counters interpreted as unsigned) in the xe driver's external buffer pin and unpin paths, and in handling of imported dma-bufs. Nested pins from multiple importers trigger repeated shrinker accounting calls, and the advisory says the fix guards these calls with pin-count transition checks and skips imported dma-bufs. The advisory does not state the attack vector, required privileges, or CVSS score. Affected and fixed kernel versions are not stated in the provided text. Workarounds and detection guidance are not stated. The advisory text is truncated, so later content may contain additional details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel Linux drm/xe NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98999	In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98999In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and... Executive summary A fix in the Linux kernel's Intel Xe graphics driver (drm/xe) addresses a stale list entry that can remain after a buffer object is unpinned by the framebuffer path. The advisory describes this as potentially leading to memory corruption and a use-after-free once the buffer is freed. The advisory text does not state a severity rating, and the excerpt provided does not describe any specific fixed version or workaround beyond the code change itself. Technical summary The flaw is a stale pinned_link list entry in the drm/xe driver. When a buffer object is pinned both externally (for example by dma-buf export) and as a display framebuffer, and the external unpin happens first, the framebuffer unpin performs the final unpin without removing the buffer from xe->pinned.late.external, so the list retains a pointer to a buffer that may later be freed. The advisory describes the consequence as list corruption and a risk of use-after-free when the list is walked or spliced. The fix moves pinned_link removal into xe_bo_account_unpin() so it runs on every unpin path. Affected and fixed version numbers, CVSS score, exploitation status, attack preconditions for an unprivileged attacker, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98998	In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98998In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform... Executive summary A Linux kernel stable-tree commit fixes a bug in the remove callback of the T-Head TH1520 HDMI bridge driver. The advisory describes it as a code correctness fix that makes teardown run on the right pointer, and it does not describe any severity rating or exploitation. Technical summary The flaw is in the th1520-dw-hdmi driver remove callback, where the platform drvdata was read back as the wrong structure type and passed to dw_hdmi_remove, so teardown ran on the wrong pointer. The advisory does not state an attack vector, preconditions, or a CVSS score. Affected kernel versions are not stated, and the fixed version is not stated beyond the commit identifier 01c83795d50ccdb441f60e89ff50767cb2f6045a. No workaround is stated. No detection guidance is stated. The commit is marked for stable backport via cc to stable@vger.kernel.org. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/01c83795d50ccdb…0e89ff50767cb2f6045a Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98997	In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO... Linux, AMDLinux, Linux kernel, amdgpu	NVD	Oct 23 13:17 UTC
CVE-2026-98997In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO... Executive summary A flaw in the Linux kernel's AMD GPU user queue code allowed a client to pin an arbitrary buffer object into the doorbell domain, which could erase that buffer's contents, including buffers shared by another client. The advisory does not state a severity rating, and the fix rejects buffers not created in the doorbell domain. Users should apply the kernel stable tree update that carries this patch. Technical summary The weakness is improper validation of a buffer object passed as a doorbell handle in amdgpu_userq_get_doorbell_index(), which pins any BO into the doorbell domain and causes TTM to discard its contents via ttm_bo_move_null(). An importing client on the same device can trigger this against a buffer another client shared with it, so the precondition is local access with a shared GEM object. The fix rejects BOs whose preferred_domains lack AMDGPU_GEM_DOMAIN_DOORBELL and returns -EINVAL. The advisory cites the fixing commit 7f7c88dbf4d543f6703e53bdeed380e886733167 upstream and the fixed-by commit f7497bbc19db4821c62b9d97b31c9086feb2d917 in the stable tree, and it names Fixes tag f09c1e6077ab. No affected or fixed kernel version ranges, CVSS score, workaround, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/112dbe2b10d6d08…99980dd960dcbfa55ff0 Score No CVSS score published. Affects Linux AMD Linux Linux kernel amdgpu NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98996	In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98996In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a... Executive summary A flaw in the Linux kernel's mount handling lets a synchronous unmount succeed on a mount that is still in use, which can detach it while a process still holds it open. The advisory does not state a severity rating or score. The advisory text shown does not state a fixed version or the vendor's recommended action. Technical summary The flaw is a logic error in the fs mount code, where propagate_mount_busy() does not perform the same checks as propagate_umount(), so busy propagated mount copies are not counted as references and a synchronous unmount succeeds. The advisory describes a container scenario in which a host shares a mount tree with a container, the container moves a cloned tree beneath a propagated copy, and a host umount of that path then detaches a mount still referenced by an open file descriptor. Preconditions are shared or slave mount propagation and the ability to create mount namespaces and move mounts, and the advisory describes these as the container's own actions. The fix teaches propagate_mount_busy() the same checks, walking propagation chains once from the top. Affected and fixed version numbers, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98995	In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98995In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount... Executive summary The advisory describes a fix in the Linux kernel's mount namespace code (fs/namespace.c) for a use-after-free flaw that can be reached through a file descriptor held on an unmounted mount. The advisory does not state a severity rating or a CVSS score. The fix is a kernel patch that the Linux stable tree has adopted, and the advisory does not describe any separate workaround. Technical summary The flaw is a dangling pointer and use-after-free in the Linux kernel mount code: mnt_change_mountpoint() moves a mount without clearing the old parent's ->overmount pointer, so a file descriptor that keeps an unmounted mount alive can leave ->overmount pointing at a freed mount, which do_lock_mount() and topmost_overmount() can then follow. The advisory says the trigger requires a file descriptor holding the unmounted mount and a mount operation targeting it. The fix adds a check in mnt_change_mountpoint() that resets the old parent's ->overmount to NULL when it points at the mount being moved, and it is tagged with Fixes ffdc52fbbd58 and stable backport for v6.17 and later. Affected and fixed version numbers beyond the commit identifiers are not stated, and no workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/08d575ee89393fd…dca7b5d7b4574cd5a564 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98994	In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98994In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of... Executive summary A flaw in the Linux kernel's statmount code can cause a read of memory belonging to a mount that has already been freed. The advisory does not describe a severity rating or any exploitation, and it does not state an impact beyond the memory access problem. The advisory shows a kernel stable tree commit as the fix, and no separate workaround is stated. Technical summary The issue is a use-after-free style race in the Linux kernel fs/namespace.c statmount_mnt_basic() function, where m->mnt_parent is read without the right lock when the mount was unmounted via a file descriptor (STATMOUNT_BY_FD). The fix reads the parent under mount_lock when the mount is not mounted, and under namespace_sem otherwise. The advisory does not state a CVSS score, an attack vector or required privileges, or a CVE-specific exploitation status. The advisory lists the Fixes tag as commit 0e5032237ee5 and says the fix applies to v7.0 and later stable kernels, but it does not give a fixed kernel version number. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/98fc6c7b6ca6761…780bd0a537b2c10fe08f Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98993	In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98993In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or... Executive summary A flaw in the Linux kernel's mount handling could let a lazily unmounted mount be copied back into a namespace with a stale unmount flag set, which can corrupt mount state. The advisory does not state a severity score or whether it is being exploited. The advisory describes a fix in the kernel's clone logic but does not state which kernel versions are fixed. Technical summary The flaw is a state-handling error where the MNT_UMOUNT flag is copied by clone_mnt() onto new mounts. A mount that was lazily unmounted but kept alive by a file descriptor on an nsfs or pidfs root can be bind-mounted again through /proc/self/fd, and the copy inherits the flag. The advisory describes resulting use-after-free style conditions, leaked namespace references, and propagation and umount logic errors. The fix adds MNT_UMOUNT to MNT_INTERNAL_FLAGS so clones never copy it, and adds a warning in umount_tree() when a mount already has the flag. Affected and fixed kernel version ranges are not stated in the advisory. A CVSS score is not stated. Workarounds are not stated. Exploitation status is not stated. Detection guidance beyond the added kernel warning is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98992	In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98992In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or... Executive summary A flaw in the Linux kernel's mount handling allows a bind mount of an unmounted mount tree, which can copy more mounts than intended when a recursive bind is used. The advisory does not state a severity score or any exploitation details. The fix refuses to walk an unmounted tree during recursive copies, and the advisory does not describe any separate workaround. Technical summary The advisory describes a flaw in the kernel function may_copy_tree() in fs/namespace.c, where an exception for nsfs and pidfs mounts allowed an unmounted mount tree to be copied. With MS_REC or AT_RECURSIVE, copy_tree() then copied every mount still attached beneath a lazily unmounted nsfs or pidfs mount kept alive by a file descriptor. The fix adds a check that returns EINVAL when a recursive copy targets a mount with no mount namespace, while copying the root alone remains allowed. The advisory lists fixed commit 7e037b1fd339d865737c8accd29abcf40130a5a0 and does not state affected or fixed kernel version numbers, a CVSS score, or a workaround. Detection guidance and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/7e037b1fd339d86…8accd29abcf40130a5a0 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98991	In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98991In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list Executive summary A flaw in the Linux kernel's mount notification code can let a local user corrupt kernel memory by queuing the same mount twice. The advisory describes it as a use-after-free that breaks later mount operations on the host. The advisory does not state a severity score, and it does not describe a fix version or workaround. Technical summary The flaw is a use-after-free caused by a mount being added to the notify_list twice within a single namespace_sem hold, which corrupts the list. The advisory says it needs a mount with MNT_SHRINKABLE to bind from, such as those created by finish_automount(), and a mount namespace with a FAN_MARK_MNTNS mark; root in a user namespace can set up both. The fix initializes to_notify in alloc_vfsmnt() so a mount already queued is not queued again. Affected and fixed kernel versions are not stated, and no workaround is stated. The advisory includes a KASAN report showing a slab-use-after-free in __list_add_valid_or_report as detection evidence. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98990	In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98990In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and... Executive summary A fix was committed to the Linux kernel stable tree for a flaw in how the kernel unmounts shrinkable submounts such as automounted NFS, AFS, CIFS, and tracefs mounts. The flaw could let a synchronous umount remove a mount that was still in use elsewhere, which the advisory describes as a busy mount being pulled out of use. The advisory does not state a severity score, and it describes the fix as a change to check each mount for references right before unmounting it. Technical summary The flaw is a race-like ordering problem in the Linux kernel mount namespace code (fs/namespace.c), where shrink_submounts() and mark_mounts_for_expiry() collect mounts to unmount before checking whether they are busy, so an earlier unmount can move a busy overmount into a position where it is unmounted without a reference count check. The advisory says the trigger requires a mount with MNT_SHRINKABLE, such as automounted NFS, AFS, or CIFS submounts or the tracefs mount under debugfs, and that bind mounts inherit the flag. The fix checks each mount with propagate_mount_busy() immediately before umount_tree() under the same namespace_sem and mount_lock hold, and it is stated to keep the algorithm linear. The advisory lists the fix commit as 18902a23ef36f83d32bafc58ae2484e6bb4bb8ef and the upstream commit as 32bf92416614a1e3ff3524fc6b780259c7aad3ef, and it names the Fixes tag 1064f874abc0. Affected kernel version ranges and the fixed version numbers are not stated in the advisory. Workarounds and exploitation status are not stated, and detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/18902a23ef36f83…fc58ae2484e6bb4bb8ef Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98989	In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98989In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the... Executive summary A flaw in the Linux kernel's mount namespace handling lets a process create a loop by recursively bind mounting namespace files from another mount namespace, which can leak memory without limit. The advisory does not state a severity score, and it describes the issue as resolved in the kernel code. Technical summary The weakness is a namespace loop check that only examines the starting dentry of a recursive bind mount, so mount namespace files nested below the source are copied without the ancestry check. The advisory says an attacker needs a process in an older mount namespace that stacks nsfs or pidfs bind mounts of another namespace's file, and it shows a repeated MS_BIND\|MS_REC call causing unbounded Shmem growth. The fix is to run the same nsfs mount check on the copied tree before it is grafted, as do_move_mount() already does. Affected and fixed kernel versions are not stated, no CVSS score is stated, no workaround is stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-98988	In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98988In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new... Executive summary A flaw in the Linux kernel's open_tree(OPEN_TREE_NAMESPACE) call can let an unprivileged user, after creating a user namespace, see files hidden under mount points in a new mount namespace. Such hidden content could be exposed that administrators or container runtimes intended to mask. The advisory does not state how severe it is, and it does not give a fix version or a vendor recommendation beyond the kernel change described. Technical summary The weakness is a mount-hiding bypass in the Linux kernel's namespace code: open_tree with OPEN_TREE_NAMESPACE copies a mount tree without preserving the covering of mount points, so content covered by a mount becomes visible in the new mount namespace. The precondition is that an unprivileged user can create a user namespace and then call open_tree and setns. The advisory says the fix makes non-recursive copies refuse mounts with something mounted below the requested directory and makes recursive copies include unbindable mounts for unprivileged callers. Affected and fixed kernel versions are not stated, no CVSS score is stated, no workaround is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98987	In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach_recursive_mnt() preallocates a... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98987In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach_recursive_mnt() preallocates a... Executive summary The advisory describes a flaw in the Linux kernel's mount namespace handling, where a mount could be attached in the wrong place and later become hard to unmount. The advisory does not state how severe the flaw is or give a CVSS score. The advisory shows a code fix to the kernel's mount logic and does not describe a separate vendor recommendation beyond applying the stable tree change. Technical summary The flaw is in attach_recursive_mnt() in fs/namespace.c, where the loop that finds the mountpoint for copied mounts skipped the topmost mount of the source chain, so a mount could be placed below the root of an nsfs dentry. The advisory describes a local scenario using bind mounts, shared and slave mounts, and move_mount(), with the result that the wrong content is shown and umount returns EBUSY. The fix changes the loop to check every mount in the chain including the topmost one. The advisory does not state affected or fixed version numbers beyond the Cc line of v6.17+, does not state a CVSS score, does not state whether it is exploited in the wild, and does not give a workaround or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/8714b44adac7b10…db3ef1710689751f0f10 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98986	In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt_ns_release() drops the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98986In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt_ns_release() drops the... Executive summary A flaw in the Linux kernel's mount namespace code can cause a crash when a fanotify mark on a mount namespace is removed from the wrong context. The advisory describes a sleeping-in-atomic-context kernel bug triggered when a task that owns a namespace exits while a mark is still attached, and it is fixed in the stable tree by moving mark removal into process context. The advisory does not state a severity score, and it gives no specific affected or fixed version numbers beyond the referenced commit. Technical summary The bug is a locking error: fsnotify_mntns_delete() takes mutexes and spinlocks but was called from an RCU callback running in softirq context, which triggers a sleeping-in-invalid-context BUG and a lockdep complaint. The advisory says a fanotify group with a FAN_MARK_MNTNS mark on another task's mount namespace is enough to trigger it, and that root in a user namespace can set this up for a namespace it owns. The fix moves fsnotify_mntns_delete() from mnt_ns_release() into free_mnt_ns(), which runs in process context, and the advisory says it is tagged for stable kernels v6.15 and later. The advisory does not state a CVSS score, affected version ranges, a workaround, or any detection guidance, and it does not say whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1a116222acdcc1b…50727ae6f28907d44594 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98985	In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98985In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the... Executive summary A flaw in the Linux kernel's pivot_root() handling could let a local user read memory after it has been freed, which can crash the system. The advisory does not state a severity score, and it describes the bug as a use-after-free found by KASAN. Technical summary The flaw is a use-after-free in path_pivot_root() in the Linux kernel namespace code. The function reads the parent of new_root and of the caller's root before checking that those mounts are in the caller's mount namespace, while holding only namespace_sem. A mount kept alive only by a file descriptor after being unmounted can have its parent freed, so the read touches freed memory; the advisory shows a KASAN slab-use-after-free report. The advisory states that both outcomes of the check return EINVAL, so the only harm is the read itself. The fix checks both mounts are in the caller's namespace before reading their parents. Affected and fixed kernel version ranges are not stated, and no workaround or detection guidance is stated. The advisory names no vendor product beyond the Linux kernel. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98984	In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir(), unlink() and rename() call... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98984In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir(), unlink() and rename() call... Executive summary The advisory describes a flaw in the Linux kernel's directory cache (dcache) code. A race between removing a directory and moving a mount onto it could leave a mount attached to a removed directory that is never cleaned up. The advisory does not state a severity rating, and it describes a fix that checks an existing flag before a mount point is set. Technical summary The flaw is a race condition in the Linux kernel's dcache handling in fs/dcache.c, where a mount could be placed on a dentry that is being removed by rmdir(), unlink() or rename(). The advisory gives a reproduction sequence in which a bind mount of the directory being removed is moved beneath an existing mount between the dont_mount() and d_delete() steps. The fix adds a cant_mount() check inside d_set_mounted(), and the fix commit is 30a1625022411a387cce9239408ece9955bc9c58 in the stable tree, with the upstream commit listed as 75f4197f1e11d2eb75c2d6f916a7d4764db621e5 and the bug introduced by commit 1064f874abc0. The advisory does not state the affected or fixed kernel version numbers, the CVSS score, the attack preconditions beyond local mount and removal activity, any workaround, or any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/30a1625022411a3…9239408ece9955bc9c58 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98983	In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98983In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces... Executive summary A flaw in the Linux kernel's namespace handling for the unshare operation can cause namespaces that a process is using to lose a reference they should keep, which can trigger a kernel warning and make those namespaces disappear from listns() output. The advisory does not state a severity rating. The fix is a kernel patch that the advisory presents as a stable tree commit, and the advisory does not state any other vendor recommendation. Technical summary This is a reference counting error (namespace active reference dropped without having been taken) in ksys_unshare() in the Linux kernel. When set_cred_ucounts() fails, the code calls put_nsproxy() on an nsproxy that was never installed, which decrements active references on namespaces shared with the caller and triggers a WARNING at kernel/nscommon.c:171. The advisory says the failure only happens when memory allocation in alloc_ucounts() fails and the caller's real uid differs from its effective uid. The fix replaces put_nsproxy() with nsproxy_free() in the bad_unshare_cleanup_nsproxy path and exports nsproxy_free(). The advisory references a fix commit and a Fixes tag for a98621a0f187, and says the change is marked for stable v7.1 and later. The advisory does not state affected or fixed version numbers for the kernel, any workaround, exploitation status, or a CVSS score, and it does not give specific detection guidance beyond the kernel warning message. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0b6f31a3c0b1606…e94b52a704174a6f23cd Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98982	In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98982In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for... Executive summary A flaw in the Linux kernel's mount handling can let a bind mount of a BPF token file reference a dentry that may be freed too early, which the advisory describes as a use-after-free style memory safety problem. The advisory does not state a severity rating or any exploitation status. The fix refuses to clone such a mount, and the advisory does not describe any other recommended action beyond applying the stable kernel update. Technical summary The weakness is a lifetime issue in the kernel's mount code: a pseudo dentry (created by d_alloc_pseudo for pipes, sockets and similar files, and marked DCACHE_NORCU) can become the root of a bind mount through /proc/self/fd/<fd>, and a lockless path walk may then read it after it has been freed. The advisory says bpf_token_create() places the token file on a bpffs mount that is in the caller's namespace, so the clone succeeds, and it describes the race involving mntput() and dput() as the trigger. The fix adds a check in __do_loopback() in fs/namespace.c that returns -EINVAL when the source dentry has DCACHE_NORCU set. The advisory does not state a CVSS score, a CVSS vector, an attack privilege level beyond the bind mount description, or whether exploitation has been observed. Affected kernel versions beyond the commit reference are not stated as ranges, and the advisory gives the stable backport target as v6.9+ only in the cc line. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/00287afa7cd989e…822b7efac33cce7d489a Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-98981	In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98981In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the... Executive summary A flaw in the Linux kernel's namespace and dentry handling lets a lookup briefly find a file that has already been covered by a mount, which can expose what the mount was hiding. The advisory describes this as a race during unlink, rmdir, and rename of mountpoints across mount namespaces. The advisory text provided is truncated, so the severity rating and vendor recommendation are not stated in the text provided. Technical summary The flaw is a race condition in the Linux kernel where unlink(), rmdir(), and rename() call detach_mounts() while the dentry is still hashed and positive, so a concurrent lookup can find the dentry after its mounts are gone and read the underlying entry. The advisory says the fix is to d_drop() the dentry inside __detach_mounts() before detaching mounts, which closes the lockless lookup path, and notes that a reference count lookup issue is left for a follow-up patch. The attack requires local access able to create mount namespaces and bind mounts, and the advisory's reproducer uses open_tree and openat2 with RESOLVE_CACHED. The advisory reports 11938 hits in 16140 unlinks over a minute in a test VM. Affected kernel versions, fixed versions, a CVSS score, workarounds, and detection guidance are not stated in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-98980	In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98980In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted Executive summary The advisory describes a flaw in the Linux kernel's path lookup code (namei) where a lookup in refwalk mode can reveal an underlying file or directory that should have been hidden by a mount placed over it, after the mounted name was unlinked. The advisory does not state a severity rating or a CVSS score. The described fix adds a check after step_into() so that entries marked with DCACHE_CANT_MOUNT that were unlinked during the walk cause a retry. Technical summary The weakness is a race in the Linux kernel's namei refwalk path, where a dentry is accepted by lookup_fast() after a reference is taken and an unlink that occurs before mounts are traversed is not detected, so an overmounted entry can be revealed. The advisory describes a local race requiring concurrent lookups and unlinks of a covered mountpoint, with the reproducer using openat2 with RESOLVE_CACHED. The fix checks the entry after step_into() for DCACHE_CANT_MOUNT together with an unhashed state and retries the lookup in that case, as added to step_into_slowpath(). The advisory does not state affected or fixed kernel versions, does not provide a workaround, and does not state a CVSS score or whether it has been exploited in the wild. Detection guidance beyond the reproducer is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98979	In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98979In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even... Executive summary A flaw in the Linux kernel's mount handling lets a local user trigger a kernel crash through fanotify when an automount is added below a mount that is in no namespace. The advisory describes this as causing a general protection fault that can block every mount operation on the system. The advisory's fix changes the check to reject unmounted and internal mounts, and the patch is in the Linux kernel stable tree. Technical summary This is a NULL or error pointer dereference (CVE-2026-98979 is described as a kernel fault) in the Linux kernel's namespace code. The parent mount check tested for a non-NULL mount namespace, but clone_private_mount() uses MNT_NS_INTERNAL, which passes that test, so count_mounts() later dereferences an error pointer. The advisory says it is reachable from userspace via a fanotify mark on the lower layer of an overlay filesystem, with debugfs given as an example that triggers a KASAN null-pointer dereference and an Oops while holding namespace_sem for writing. The fix replaces the parent->mnt_ns check in do_add_mount() with is_mounted(), so the open fails with EINVAL. The advisory does not state affected or fixed kernel version numbers, a CVSS score, exploitation in the wild, or a workaround, and these are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/35f2013f83ef16f…1c4c3a8e8d161580d574 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.4	CVE-2026-98978	In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98978In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special Executive summary The advisory describes a fix in the Linux kernel's mount handling code, where a locked mount could be expired and unmounted in a way that revealed files underneath it. The advisory does not state how severe the issue is or give a CVSS score. The fix is a kernel patch that stops locked mounts from being expired, and the advisory points to the stable tree commit as the remedy. Technical summary The flaw is in the Linux kernel's namespace and mount code (fs/namespace.c), where shrink_submounts() could expire a mount that had become locked after being placed beneath a locked mount with MOVE_MOUNT_BENEATH, which could reveal covered directories. The advisory describes the attack as requiring a user namespace owner to set up the mount arrangement, but it does not state the exact attack vector or privilege requirements beyond that. The fix makes shrink_submount() skip locked mounts, adds a warning assert in mark_mounts_for_expiry(), and changes plain umount() of an unlocked mount with a locked child to return EBUSY. The advisory does not state affected or fixed kernel version numbers, a CVSS score, workarounds, exploitation status, or specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/6b8dc3713a76346…bab46cbfc8d7070f534c Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98977	In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98977In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces,... Executive summary The advisory describes a flaw in the Linux kernel's handling of mount locking when automounts are triggered across user namespaces. The advisory does not state a severity rating or a CVSS score. The stated fix is a change to how the kernel decides which namespace owns a mount during lookup, and the advisory does not describe any other vendor recommendation. Technical summary The flaw is an incorrect lock check in attach_recursive_mnt() that involves mount propagation and automounts across user and mount namespaces. The advisory says a locked copy of a host mount can receive propagation in a child namespace, so a flag change that should be blocked can end up on the wrong mount, and a reproducer is described that requires a directory descriptor on a nosuid,nodev,noexec shared mount and an automount that is not yet active. The advisory states that the fix compares against the owner of the namespace where the mount is actually attached, leaving normal cases unchanged. Affected kernel versions, fixed versions, workarounds, exploitation status, and detection guidance are not stated in the advisory text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98976	In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attach_recursive_mnt()... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98976In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attach_recursive_mnt()... Executive summary A flaw in the Linux kernel's mount namespace code can let a user namespace owner remove a lock that protects a hidden path, exposing content that should stay covered. The advisory describes this as a case where a secret could be revealed to the namespace owner. The advisory does not state a severity score, and it does not state a vendor recommendation beyond the code fix described. Technical summary The weakness is a lock-state handling error in attach_recursive_mnt() when MOVE_MOUNT_BENEATH is used, where MNT_LOCKED is transferred from the top mount to a mount placed beneath it. A user namespace owner can exploit this after a host mount and unmount propagate into the namespace, leaving the covering mount unlocked so it can be unmounted to reveal the underlying path. Preconditions are a shared mount propagating into a user namespace and a locked cover on a path. The advisory describes the fix as only transferring the locked property for mounts the caller placed, and locking propagated copies beneath a locked mount. Affected and fixed version numbers are not stated, no CVSS score is stated, no workaround is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98975	In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset... Linux, XFSLinux, Linux kernel, XFS	NVD	Oct 23 13:17 UTC
CVE-2026-98975In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset... Executive summary A flaw in the Linux kernel's XFS file system code can cause a file that shares data with another file to be overwritten in place instead of copied, corrupting the other file. The advisory does not state a severity score or whether the flaw is being actively exploited. The advisory describes a fix that stops the exchange path from clearing the reflink flag, but it does not name specific fixed kernel versions in the text provided. Technical summary This is an integrity flaw in the XFS file system's exchange-range and swapext handling, where the reflink (shared block) flag is wrongly moved or cleared when mappings are exchanged. When an exchange covers both files from offset 0 to i_disk_size, the flag is handed to the other file even though shared blocks may remain past i_disk_size, so a later write happens in place instead of copy-on-write and alters the file sharing those blocks. The advisory says the fix stops moving reflink flags, sets the flag on both inodes for XFS_IOC_SWAPEXT, and ensures both have a CoW fork. Attack vector, required privileges, affected and fixed version numbers, workarounds, and detection guidance are not stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux XFS Linux Linux kernel XFS NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98974	In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete... LinuxLinux, Linux kernel, Linux XFS	NVD	Oct 23 13:17 UTC
CVE-2026-98974In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete... Executive summary The Linux kernel's XFS filesystem has a flaw in its exchange-range file operation that can leave a file sharing data blocks past its end, so a local user could overwrite data they should not be able to change. The advisory does not state a severity score or whether it is being exploited, and it does not give a fix version or workaround. Technical summary The flaw is incorrect file size handling in XFS_IOC_EXCHANGE_RANGE when the TO_EOF flag is used with a nonzero offset. The code swaps on-disk and in-core sizes, which lets a file keep shared blocks beyond EOF and lets a later exchange clear the reflink flag, so an extending write can rewrite a block shared with another file. The advisory describes a multi-step local sequence using reflink and exchange-range on a filesystem where mkfs.xfs enables both by default, but it does not include the proof of concept. Affected kernel versions, fixed versions, workarounds, and detection guidance are not stated. A CVSS score and exploitation status are also not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel Linux XFS NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98973	In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked list_del in drm_bridge_add() When re-adding a bridge that was previously removed,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98973In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked list_del in drm_bridge_add() When re-adding a bridge that was previously removed,... Executive summary The advisory describes a race condition in the Linux kernel's DRM bridge code, where a list entry is removed without holding the lock that protects the list, which can corrupt kernel data structures. The advisory does not state how severe the issue is, and the fix is a kernel patch that adds the missing lock around the list operation. Technical summary The flaw is an unlocked list_del_init() in drm_bridge_add() in drivers/gpu/drm/drm_bridge.c, which removes a re-added bridge from bridge_lingering_list without holding bridge_lock, risking list corruption against concurrent drm_bridge_remove(), __drm_bridge_free(), and the debugfs 'bridges' reader. The fix wraps the list_empty() check and list_del_init() in mutex_lock(&bridge_lock) and mutex_unlock(&bridge_lock). The advisory names the Fixes commit 17805a15d175 but does not state affected or fixed kernel version numbers, attack vector, required privileges, or severity score. Workarounds, exploitation status, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/b62e3db8cdc1680…90591e872f485148541a Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98972	In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() After seeing the patch [1] to guard... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98972In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() After seeing the patch [1] to guard... Executive summary This advisory concerns a fix in the Linux kernel's cpuset control group code, where a function could read a pointer that might be stale while a new cgroup filesystem is being mounted, creating a potential use-after-free condition. The advisory text does not state a severity rating, and it does not describe any known exploitation. The fix is a kernel patch that stops the function from reading that pointer directly and uses a new cached flag instead. Technical summary The flaw is a potential use-after-free in the Linux kernel cpuset controller, caused by is_in_v2_mode() reading cpuset_cgrp_subsys.root directly in a context where the cgroup filesystem may be rebinding and the pointer may be stale. The fix adds a cpuset_v2_mode flag that is written in cpuset_bind() and read through READ_ONCE in is_in_v2_mode(). The advisory names the fixing commit (988bf67a13890a37a33201f95947095ca9bec856) and the upstream commit e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469, and lists Fixes tag b8d1b8ee93df. Affected and fixed kernel version ranges are not stated in the advisory. Attack vector, required privileges, CVSS score, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/988bf67a13890a3…01f95947095ca9bec856 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98971	In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98971In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the... Executive summary A bug in the Linux kernel GPIO driver for Exar devices was fixed in the stable tree. The advisory describes a flaw that can release the wrong device ID, which may affect other devices sharing the same ID space. The advisory does not state a severity rating, and the stated remedy is the upstream kernel patch that initializes the ID before registering its cleanup. Technical summary The flaw is an incorrect resource-cleanup ordering in gpio_exar_probe in drivers/gpio/gpio-exar.c, where the allocated ID was stored after devm_add_action_or_reset was called. If that call fails, the cleanup runs immediately and releases ID 0, which can leak a nonzero allocated ID or free ID 0 belonging to another device. The advisory does not state the attack vector, required privileges, or whether it is exploitable by an attacker. Affected kernel versions are not stated as a range, and no fixed version number is given beyond the referenced stable commit 01318927a9055136c207399eeb36ce07becac179. No workaround or detection guidance is stated. The fix moves the assignment exar_gpio->index = index above the devm action registration. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/01318927a905513…399eeb36ce07becac179 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98970	In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98970In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never... Executive summary The advisory describes a resource leak in the Linux kernel's vc4 graphics driver, which handles display and GPU buffers on certain Raspberry Pi-class hardware. The leak occurs when the driver is unbound, and the advisory does not state a severity rating for it. The published fix frees a buffer cache list that was previously never released. Technical summary The flaw is a memory leak (CWE class not stated) in the drm/vc4 driver: vc4_bo_cache_destroy() purges cached buffer objects but never frees the size list, so the list leaks on every unbind. The advisory does not state an attack vector, required privileges, or whether an attacker can trigger it. Affected and fixed version ranges are not stated beyond the referenced upstream commit b41ff8b529278216cba22a5dcdc93fea2a3a9619 and stable commit 035ad1bc964f6698e9b06c26ffe94bcac08dadea. The fix adds a single kfree(vc4->bo_cache.size_list) call in drivers/gpu/drm/vc4/vc4_bo.c. No workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Linux vc4 DRM driver Summarized from git.kernel.org/stable/c/035ad1bc964f669…6c26ffe94bcac08dadea Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98969	In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98969In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a... Executive summary The advisory describes a flaw in the Linux kernel's net/sched text ematch code that can leak kernel memory to a local user who has network administration rights. The advisory does not state a severity score, and it describes the fix as rejecting malformed attributes that lack a terminating NUL byte. Technical summary The flaw is an out-of-bounds read in em_text_change() in net/sched/em_text.c, where a 16-byte algo array without a NUL terminator is passed to textsearch_prepare() and then to request_module() on the TS_AUTOLOAD retry, disclosing adjacent kernel memory. The precondition is CAP_NET_ADMIN on the target network namespace, which the advisory says can be obtained with unshare -Urn, and the attacker must add a basic filter with a text ematch. The fix adds a memchr check that rejects the attribute with -EINVAL when no NUL byte exists within TC_EM_TEXT_ALGOSIZ bytes. Affected and fixed kernel versions are not stated, no CVSS score is stated, and no workaround or detection guidance is stated beyond the upstream commit reference. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/00bcc303000bac5…eed054d77372b38ace0f Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-98968	In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98968In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive... Executive summary The advisory describes a use-after-free flaw in the Linux kernel's amt driver, which handles Automatic Multicast Tunneling. A packet queued in a traffic queue can outlive the tunnel it refers to, and sending it after the tunnel is freed can crash or corrupt memory. The advisory does not state a severity rating or a score, and it does not state a fixed version. The fix changes how the relay sends its General Queries so they no longer wait in a queue. Technical summary The flaw is a use-after-free (CWE class not stated) in the amt driver of the Linux kernel, where an skb queued in a qdisc holds a raw pointer to a tunnel in skb->cb that may be freed before dequeue. The advisory gives an example where a netem delay on the amt device outlives a tunnel that expires after 135s with igmp_qrv set to 1, and shows a KASAN slab-use-after-free trace in amt_dev_xmit(). The fix sends the relay's General Query directly from the receive path via amt_send_igmp_gq() and amt_send_mld_gq() and removes the query branch of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb. Affected and fixed kernel versions are not stated, no workaround is stated, and no exploitation status or CVSS score is stated. The advisory describes behaviour changes such as queries no longer passing through egress hooks and no longer being counted as tx_dropped, but gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98967	In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list... Linux, ChelsioLinux, Linux kernel, Chelsio cxgb4	NVD	Oct 23 13:17 UTC
CVE-2026-98967In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list... Executive summary The advisory describes a fix in the Linux kernel's Chelsio cxgb4 ch_ktls driver, which handles inline TLS offload. It addresses a locking issue that could cause a system to hang when connection cleanup races with network receive processing. The advisory does not state a severity rating, and the fix is a code change that the kernel stable tree has merged. Technical summary The flaw is a locking problem in the chcr_ktls_dev_del() and chcr_ktls_dev_add() error paths, which called xa_erase() without disabling softirqs while the tid_list XArray is also modified from the receive softirq path. A receive softirq for another connection on the same CPU could interrupt the erase and spin on a lock held by the interrupted task. The fix replaces xa_erase() with xa_erase_bh() at both sites. The advisory does not state affected or fixed version numbers, attack vector or privileges needed, a CVSS score, workarounds, or detection guidance. The advisory names the Fixes commit 65e302a9bd57 and a commit ID of 4c9dc0faca98084922caeb689579d338cf3e1c29. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/4c9dc0faca98084…eb689579d338cf3e1c29 Score No CVSS score published. Affects Linux Chelsio Linux Linux kernel Chelsio cxgb4 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98966	In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog,... LinuxLinux, Linux kernel, Linux bonding driver	NVD	Oct 23 13:17 UTC
CVE-2026-98966In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog,... Executive summary The advisory describes a resource leak in the Linux kernel's bonding driver, where BPF programs attached through XDP were not released when the XDP program was replaced. Over time, leaked programs could accumulate on affected systems. The advisory does not state a severity rating, and the fix is a committed kernel patch that corrects the reference handling. Technical summary This is a reference-counting resource leak in the bonding driver's bond_xdp_set function, where the reference on the old BPF program was not released when the program was replaced or removed. The advisory does not describe an attack vector, privileges required, or any memory corruption or code execution impact. The patch changes the logic so the old program is released whenever one exists, and it adjusts the static branch counter for the transitions from no program to a program and from a program to none. The advisory names Fixes commits 9e2ee5c7e7c3 and 6d5f1ef83868, but it does not state affected or fixed kernel version numbers. Workarounds, exploitation status, CVSS score, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/184b5ddf82d45d6…83719a2e453392512bd2 Score No CVSS score published. Affects Linux Linux Linux kernel Linux bonding driver NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-98965	In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of... Linux, IntelLinux, Linux kernel, Intel Ethernet Controller E810-XXV for SFP	NVD	Oct 23 13:17 UTC
CVE-2026-98965In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of... Executive summary The advisory describes a race condition in the Linux kernel's Intel ICE network driver, which supports Intel Ethernet Controller E810 adapters. Under sustained network load on arm64 machines, this can crash the kernel. The advisory does not state a severity rating, and it describes a fix that restores ordered register writes in the transmit path. Technical summary The flaw is a memory ordering issue in the ice driver transmit path, where the tail doorbell is written with writel_relaxed() rather than writel(). On arm64, this can let the NIC start transmitting before the dynamic queue limit (DQL) byte count update is visible, which triggers a BUG_ON in dql_completed() and a kernel crash. The advisory describes the trigger as sustained network load on an Intel Ethernet Controller E810-XXV for SFP (rev 02) system, and states that the crash was reproduced reliably by the user. The fix restores writel() in the transmit doorbell path, reverting the change made in commit ccde82e90946. The advisory does not state affected or fixed version numbers, CVSS score, attack vector or privileges required, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Linux Intel Linux Linux kernel Intel Ethernet Controller E810-XXV for SFP NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-98964	In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98964In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns... Executive summary The advisory describes a fix in the Linux kernel's NVMe target code, where a cleanup step could use the wrong PCI peer-to-peer device after a metadata allocation failure. The advisory does not state how severe the issue is, and it does not describe any recommended action beyond the upstream kernel fix. Technical summary The flaw is in nvmet_req_alloc_p2pmem_sgls() in drivers/nvme/target/core.c. When the data scatter-gather allocation succeeds but the metadata allocation fails, the out_free_sg path calls pci_p2pmem_free_sgl() with req->p2p_dev before that field has been assigned, so the wrong PCI device may be used. The fix passes the local p2p_dev argument instead, with a one-line change. The advisory does not state the vulnerability class beyond this description, the attack vector or required privileges, the affected or fixed kernel version numbers, a CVSS score, workarounds, or detection guidance. The commit references Fixes: bcd9a0797d73 and was signed off on 2026-09-30 and committed to the stable tree on 2026-10-15. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/32f21607911a1f6…f93a6c28fe6f8490aa98 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98963	In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio If all bios finish before... LinuxLinux, Linux kernel, Linux btrfs	NVD	Oct 23 13:17 UTC
CVE-2026-98963In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio If all bios finish before... Executive summary A fix in the Linux kernel's btrfs file system code resolves a flaw in how encoded reads issued through io_uring are cleaned up. The advisory does not state how severe the flaw is or whether it can be exploited, and it does not give a CVSS score. The change is a kernel stable-tree patch, so the recommended action is to apply the kernel update that contains this commit. Technical summary The flaw is a resource handling error in the btrfs encoded read path for io_uring commands. If all bios finish before btrfs_encoded_read_regular_fill_pages() returns, the function returned the I/O status, and a negative errno caused btrfs_uring_read_extent() and btrfs_uring_read_finished() to both unlock and free the same resources. The fix makes the function always return -EIOCBQUEUED so only the deferred path cleans up. The advisory names the fixing commit 80a8dbb30d2b00b9c671b02bd73f700f6d20100f and the Fixes tag 34310c442e17, but it does not state the affected or fixed kernel version numbers, the attack vector or required privileges, a workaround, or any detection guidance. Whether the issue can be triggered by an unprivileged user is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/033dda5b321f016…18a8d5c8607ae8675b14 Score No CVSS score published. Affects Linux Linux Linux kernel Linux btrfs NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98962	In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uring_read_extent(), the caller always... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98962In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uring_read_extent(), the caller always... Executive summary This advisory describes a memory handling bug in the Linux kernel's btrfs file system code, where a buffer used for encoded reads was not freed when a read failed. The advisory does not state how severe the issue is or whether it can be exploited. The provided text is a stable kernel commit that fixes the problem, and it does not state any separate vendor recommendation beyond applying the fixed kernel code. Technical summary The flaw is a resource handling error in the btrfs io_uring encoded read path (btrfs_uring_encoded_read in fs/btrfs/ioctl.c), where the iov allocation was not freed when btrfs_uring_read_extent() returned an error other than -EIOCBQUEUED. The fix makes the failure path fall through to out_free so the iov is released. The advisory does not state the attack vector, required privileges, or whether the flaw leads to a crash, leak, or code execution. It does not state affected or fixed version ranges beyond the commit itself, does not provide a CVSS score, and does not provide workarounds or detection guidance. The commit references Fixes: 34310c442e17 and was posted in the stable tree. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/578ef517142420c…b364ad4b3490b85469fb Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98961	In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs_uring_read_extent() runs... LinuxLinux, Linux kernel, Linux btrfs	NVD	Oct 23 13:17 UTC
CVE-2026-98961In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs_uring_read_extent() runs... Executive summary This advisory covers a fix in the Linux kernel's btrfs file system code, where a failed io_uring encoded read could leave a file's inode lock and extent lock held. The advisory describes this as a resolved kernel bug and does not state its severity or give a CVSS score. The fix is to release the locks in the calling code on every failure path, and the advisory does not state any separate action beyond applying the kernel update. Technical summary The flaw is a lock handling error in btrfs_uring_read_extent(), where the inode shared lock and extent lock taken by btrfs_encoded_read() were not released when the function failed, and a pages-array allocation failure returned -ENOMEM without unlocking at all. The patch moves the unlock into the caller, btrfs_uring_encoded_read(), for all failure returns, while the deferred -EIOCBQUEUED path still unlocks in btrfs_uring_read_finished(). The advisory names the fix commit as b6e8add5d79d1f6f819a054c833bab452bd7365d and the Fixes tag as 34310c442e17, but it does not state any affected or fixed kernel version numbers. Attack vector, privilege requirements, exploitability, and workarounds are not stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2797eb38773a969…deec71eb2144645400b2 Score No CVSS score published. Affects Linux Linux Linux kernel Linux btrfs NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98960	In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io_uring encoded data across -EAGAIN Returning -EAGAIN while leaving... LinuxLinux, Linux kernel, Linux btrfs	NVD	Oct 23 13:17 UTC
CVE-2026-98960In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io_uring encoded data across -EAGAIN Returning -EAGAIN while leaving... Executive summary This advisory describes a resource leak in the Linux kernel's btrfs file system code, where memory used for io_uring encoded reads and writes could be leaked if a request was cancelled or the ring exited before it was reissued. The advisory does not state how serious the issue is, and it does not say whether an attacker could exploit it. The fix is a kernel patch in the stable tree, and the advisory does not state any other vendor recommendation. Technical summary The flaw is a memory leak (resource management error) in the btrfs io_uring encoded read and write paths, where data stored in the command PDU across an -EAGAIN return was not freed if the request was cancelled or the ring exited before reissue. The fix returns -EAGAIN before allocation on writes and frees data on nowait -EAGAIN on reads, and clears bc->data after freeing. The advisory does not state the attack vector, required privileges, or CVSS score. It does not state affected or fixed version numbers beyond the referenced fixing commits, and it does not state any workaround or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/4d9c1e0a7fb2cfb…4acafc194d2c15c3e83e Score No CVSS score published. Affects Linux Linux Linux kernel Linux btrfs NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-98959	In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98959In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item... Executive summary The advisory describes a flaw in the Linux kernel's btrfs file system code. Replacing the value of one extended attribute (xattr) with a value of a different size can corrupt the file system's metadata and drop the attribute. The advisory does not state a severity rating or a CVSS score. Technical summary The flaw is a metadata corruption bug in the btrfs xattr replace path in the Linux kernel. When several xattrs share the same crc32c name hash, they are packed into one btrfs_dir_item, and replacing one with a value of a different size leaves the new item partly uninitialized (name, name length, key, flags and transaction ID are not set). The tree checker then detects corruption at writeback and the filesystem aborts on unmount. The attack vector and privileges needed are not stated beyond use of the setxattr(2) syscall family. The advisory includes a reproduction script and dmesg output, but the fixed kernel version, affected version range, and any workaround are not stated in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98958	In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments... Linux, MediaTek, Inc.Linux, Linux kernel, MediaTek, Inc. mt76	NVD	Oct 23 13:17 UTC
CVE-2026-98958In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments... Executive summary The advisory describes a fix in the Linux kernel's mt76 wireless driver for MediaTek Wi-Fi chipsets, where a packet counter could drift upward on multi-link peers and eventually block a station from transmitting. The advisory does not state a severity rating, and the patch is presented as a resolved kernel fix. The advisory does not give an explicit recommendation beyond the referenced commit. Technical summary The flaw is a counter accounting error in the mt76 Wi-Fi driver: the increment of wcid->non_aql_packets and its decrement on completion could land on different link wcids for MLO peers, so the count grows until the station is blocked, which the advisory frames as a denial-of-service style condition. The fix keeps the counter on the primary link's wcid via a new helper, mt76_wcid_primary(), in mt76.h and tx.c. The advisory cites the fixed commit 752770d7a58c821c17909c3ca67f9f14ab146a40 and the Fixes tag 86c051f2c418, but it does not state affected or fixed kernel version ranges, a CVSS score, an attack vector or required privileges, exploitation status, or workarounds. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/752770d7a58c821…9c3ca67f9f14ab146a40 Score No CVSS score published. Affects Linux MediaTek, Inc.Linux Linux kernel MediaTek, Inc. mt76 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98957	In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916... Linux, MediaTek, Inc.Linux, Linux kernel, MediaTek, Inc. mt7915	NVD	Oct 23 13:17 UTC
CVE-2026-98957In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916... Executive summary The advisory describes a Linux kernel fix for the mt76 mt7915 WiFi driver, which affects systems using MediaTek MT7915 and MT7916 wireless hardware. The advisory does not state a severity rating, and it describes the problem as warnings and system instability when the module is unloaded and reloaded. The fix is a kernel patch that disables receive NAPI processing when the device is removed. Technical summary The flaw is a resource-handling bug in the mt7915 driver: the driver destroys receive NAPI contexts without first disabling them, which triggers kernel warnings in __netif_napi_del_locked() and page_pool_disable_direct_recycling() when the mt7915e module is unloaded with an MT7916 device. The advisory states that the system generally becomes unstable after the module is reinserted. The patch adds a loop in mt7915_stop_hardware() that calls napi_disable() on each non-WED-RRO receive queue, and the advisory says the tx side is handled by the generic mt76 code. The advisory does not state a CVSS score, attack vector or required privileges, exploitation status, affected or fixed version numbers, or workarounds. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0281dac1e213329…b02e612de7f1477a52d7 Score No CVSS score published. Affects Linux MediaTek, Inc.Linux Linux kernel MediaTek, Inc. mt7915 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98956	In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiod_set_value() emits a WARN when the GPIO provider... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98956In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiod_set_value() emits a WARN when the GPIO provider... Executive summary This advisory concerns a change to the Linux kernel audio codec driver for the ADAU1372 chip, which lets the driver use GPIO pins that may sleep (such as those on I2C GPIO expanders) to power the chip down. The advisory does not state a severity rating, and it does not describe any exploitation or security impact. The fix is a kernel stable tree commit, and the advisory does not give a specific recommendation beyond applying it. Technical summary The change replaces gpiod_set_value() with gpiod_set_value_cansleep() for the powerdown GPIO in sound/soc/codecs/adau1372.c, which removes a kernel WARN that occurred when the GPIO provider can sleep. The commit message says the powerdown GPIO is only manipulated in process context, so the sleeping variant is safe. The advisory does not state a vulnerability class, attack vector, or preconditions for exploitation, and it does not state any affected or fixed kernel versions beyond the commit itself. It does not state any workaround or detection guidance. The commit is referenced as upstream commit 64dd172bbffe6135d79a06ddad53dd2da4d8bd62 and fixes commit 6cd4c6459e47. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/47c0c7a051b70d3…d5dc27b23283c28c3555 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98955	In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98955In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes... Executive summary A flaw in the Linux kernel's flow dissector can cause it to compute a wrong transport header offset for large network packets, which may point it inside the Ethernet header. The advisory does not state a severity rating or a CVSS score. The advisory describes the fix in the kernel commit but does not state a specific vendor recommendation beyond applying the resolved kernel code. Technical summary The flaw is an integer truncation issue in __skb_flow_dissect(), where min_t(u16, ...) casts both values to u16 before comparing, so skb->len values of 65536 or more can produce a bogus small thoff. The advisory says the case arises with GSO skbs larger than 64KB built through AF_PACKET with PACKET_VNET_HDR, and with BIG TCP and TAP frames once a planned patch is applied, which are the preconditions described. The fix compares values as u32, caps an unrepresentable offset to U16_MAX, and reports dissection as failed while still setting thoff. Affected and fixed kernel version numbers are not stated in the advisory. Workarounds are not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98954	In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in __virtio_net_hdr_to_skb() Commit 9e8db5913264 ("net: avoid false... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98954In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in __virtio_net_hdr_to_skb() Commit 9e8db5913264 ("net: avoid false... Executive summary A flaw in the Linux kernel's virtio network header handling can cause an out-of-bounds memory read when GSO packets with malformed or unusual network headers are processed. The advisory does not state how severe the issue is or give a CVSS score. The advisory describes a fix in the kernel code but does not state any workaround or action for administrators beyond the fix itself. Technical summary The vulnerability is an out-of-bounds read (reported by KASAN as slab-out-of-bounds in skb_gso_transport_seglen) caused by skipping flow dissection for GSO packets in __virtio_net_hdr_to_skb(). Because skb->network_header was zero-initialized in some callers, malformed packets or packets with IPv4 options or IPv6 extension headers could leave skb->transport_header unset, and tcp_hdrlen() then read beyond the buffer. The advisory describes the fix as initializing skb fields in tun_get_user(), tun_xdp_one(), virtnet_receive_done() and raw_verify_header(), removing the unvalidated fallback path, and moving the protocol match check after flow dissection. Affected and fixed kernel version numbers are not stated in the advisory. A workaround is not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98953	In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink_rel reference leak when notify work is... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98953In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink_rel reference leak when notify work is... Executive summary A reference leak in the Linux kernel's devlink subsystem can cause kernel memory and index entries to accumulate when nested devlink instances are registered and unregistered while notification work is pending. The advisory does not state a severity rating, and the fix is a kernel patch in the stable tree that corrects the reference handling. Technical summary The flaw is a reference counting error (leak) in devlink_rel_nested_in_notify_work_schedule() and the reschedule path in devlink_rel_nested_in_notify_work() in net/devlink/core.c, where the return value of schedule_delayed_work() is ignored, so a reference is taken for work that is already pending and never dropped. The advisory says it is easy to trigger by registering and unregistering a nested devlink instance while the parent lock is held, and that 100 iterations leak 100 devlink_rel objects. The advisory does not state an attack vector, required privileges, or impact beyond the leak, and it does not state a CVSS score or exploitation status. The fix drops the extra reference when the work was already pending, and it cites the upstream commit c5381ae1cd1481cc431c2bd79460472c6f1d3ce3. The advisory does not state affected or fixed kernel version numbers, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/8c7830e0120e6e1…212fd5b79b3092496f87 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.3	CVE-2026-98952	In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp_encap_recv() only makes sure that the UDP header... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98952In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp_encap_recv() only makes sure that the UDP header... Executive summary A flaw in the Linux kernel's PFCP tunnel receive code could let a specially crafted short packet cause the kernel to read beyond the end of packet data, with the stray bytes stored in tunnel metadata. The advisory does not state a severity score. The fix is a kernel patch that checks and pulls up the session identifier before reading it, and the advisory points to the stable kernel tree commit as the remedy. Technical summary This is an out-of-bounds read (CWE class not stated) in the pfcp_encap_recv and pfcp_session_recv path of the Linux kernel PFCP driver. The condition arises when a short PFCP packet has the S flag set, or when the session header lies in a fragment, so the 8 byte SEID is read past the linear data. The fix, which the advisory shows as a diff to drivers/net/pfcp.c, pulls up to the end of the SEID, drops packets too short to contain it, and reloads the header pointer. The advisory references the fix as Fixes commit 6dd514f48110 and gives the fixing commit as 23609bce9e1de525d1d0e73fc68c6e7971d0b49e. Affected kernel version ranges and attack preconditions beyond the packet shape are not stated, and no workaround, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/23609bce9e1de52…e73fc68c6e7971d0b49e Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98951	In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count`... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98951In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count`... Executive summary This advisory covers a fix in the Linux kernel for the RISC-V ptrace interface, where register buffers could hold uninitialized stack data after a short write request. The advisory does not state a severity rating, and it does not describe the impact beyond corrupting the target's vector state or shadow stack pointer. The recommended action is to apply the kernel stable tree patch that zero-initializes these buffers before copying user data. Technical summary The flaw is an uninitialized memory use in the RISC-V ptrace regset set handlers: user_regset_copyin() copies only count bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that data is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. The fix adds memset calls that zero both buffers before copyin, matching the existing get path. The advisory does not state the attack preconditions, the affected kernel version ranges, a CVSS score, or any workaround, and it does not give detection guidance. The fixed commit is 59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97, and the advisory names Fixes commits 9300f0043974 and 2af7c9cf021c. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/59052a88ba5fe4a…b3a0a42aa5d453d3bb97 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98950	In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98950In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the... Executive summary A flaw in the Linux kernel's flow dissector, which parses packet headers, can cause incorrect packet offsets when a BPF flow dissector handles large packets. The advisory does not state a severity rating, and the fix is a kernel stable tree patch that adds a cap on a length value. Technical summary The bpf_flow_dissect() function clamps offsets returned by a BPF program using a u16 type, so when the header length hlen exceeds 65535 the upper bound is truncated and nhoff and thoff can be forced to zero. The advisory describes this as a u16 truncation bug related to an earlier fix for skb->len, and the fix caps hlen to U16_MAX before clamping. The advisory does not state a CVSS score, attack vector details beyond the BPF flow dissector path, exploitation status, affected kernel version ranges, or workarounds. The patch is shown in a stable tree commit, and the advisory does not explicitly list fixed version numbers beyond the commit reference. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3fb5ad2951a6df9…4f06cd70f20c50a2eb2a Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98949	In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm_bo handling in remap() When a map overlaps part of an existing... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98949In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm_bo handling in remap() When a map overlaps part of an existing... Executive summary The advisory describes a flaw in the Linux kernel's Imagination GPU driver (drm/imagination) where splitting an existing memory mapping leaks GEM object references and can link mappings to the wrong buffer object. The advisory does not state a severity rating or a CVSS score. The fix is a kernel patch that changes how the driver links split mapping parts, and the advisory presents it as a resolved fix in the stable tree. Technical summary The flaw is a reference-counting and object-linkage error in pvr_vm_gpuva_remap() in drivers/gpu/drm/imagination/pvr_vm.c, which leaks one GEM reference per split and links split parts to the wrong vm_bo, triggering a kernel warning in drm_gpuva_link. The advisory does not state the attack vector, privileges required, or whether it is remotely or locally triggerable beyond the driver's map ioctl path shown in the trace. Affected and fixed version ranges are not stated in the advisory text; only the upstream commit 196d4d10c1b33ae176685ff42a9994a5952b1d0f is given. No workaround is stated. Detection guidance is limited to the kernel warning and the 'bytes of shmem still held after close' message shown in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/196d4d10c1b33ae…5ff42a9994a5952b1d0f Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98948	In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create()... LinuxLinux, Linux kernel, Linux mlxsw	NVD	Oct 23 13:17 UTC
CVE-2026-98948In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create()... Executive summary This advisory covers a resource leak in the Linux kernel mlxsw driver, which handles Mellanox/NVIDIA Spectrum switch hardware. The leak occurs when flower classifier templates are created, so port range hardware registers are not released. The advisory does not state a severity rating, and the text describes the fix as a kernel stable tree patch rather than giving explicit upgrade instructions. Technical summary The flaw is a resource leak (missing release of port range registers) in mlxsw_sp_flower_tmplt_create() in the Linux kernel's spectrum_flower code. A stack-local rule structure parsed from a flow_cls_offload template could acquire port range registers that were never freed, including through chain template deletion. The fix factors the resource release code out of mlxsw_sp_acl_rulei_destroy() into mlxsw_sp_acl_rulei_free() and calls it from tmplt_create(). The advisory names commit 7ea07afb230f1342ab0f9365edd0aae137f425d3 and a Fixes tag referencing fe22f7410527, but does not state affected or fixed kernel version numbers, attack vector, privileges required, CVSS score, workarounds, or detection guidance. Those points are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3938430f0237c59…6a366e7657b2b7f8d0bb Score No CVSS score published. Affects Linux Linux Linux kernel Linux mlxsw NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98947	In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98947In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the... Executive summary A memory leak in the Linux kernel's vsock driver, in the VMware VMCI transport, can occur when a datagram socket is closed. The advisory does not state a severity rating or a score, and it does not describe any vendor-recommended fix beyond the code change described. Technical summary The flaw is a memory leak in vmci_transport_recv_dgram_cb() in the Linux kernel vsock VMCI transport. During socket closure, incoming datagram packets can be queued to the socket backlog and then moved back to the receive queue after it has been purged, so they are never freed. The advisory describes the trigger as a datagram socket being closed while packets are arriving from the VMCI interrupt path, and it reports a syzkaller finding. The fix described adds a receive queue cleanup in the socket destructor. The advisory does not state affected or fixed kernel versions, a CVSS score, workarounds, or any detection guidance, and it does not say whether exploitation has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: VMware VMCI Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98946	In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98946In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt... Executive summary The advisory describes a flaw in the Linux kernel's vc4 graphics driver for the Broadcom V3D GPU, which is used on Raspberry Pi boards. A race during power transitions can cause spurious interrupts that may schedule memory work after it was already cancelled. The advisory does not state a severity score, and it does not state a fixed version or any workaround beyond the kernel change described. Technical summary The flaw is an interrupt race in the drm/vc4 driver: on Raspberry Pi 0-3 the ARMCTRL interrupt controller has no active state, so synchronize_irq() cannot see a CPU that has read the pending register but not yet entered the handler. During a power transition vc4_irq() may run after V3D is powered off, where register reads return 0xdeadbeef, which sets FLDONE, FRDONE and OUTOMEM and can schedule vc4_overflow_mem_work() after it was cancelled. The advisory says the fix disables the interrupt line across the PM transition and requests the IRQ disabled before the first runtime resume. The advisory does not state affected or fixed version numbers, CVSS score, exploitability or attack vector, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Broadcom V3D Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98945	In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98945In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where... Executive summary The advisory describes a fix in the Linux kernel's HID Steam driver (hid-steam) that closes a narrow window during device teardown where callbacks could still be scheduled and refer to freed memory. The advisory does not state a severity rating or a specific impact beyond this, and it does not describe a recommended action beyond the kernel stable tree patch. Technical summary The flaw is a teardown ordering problem in drivers/hid/hid-steam.c where work callbacks could still be scheduled during cleanup, leaving a dangling pointer to the freed steam struct, which suggests a use-after-free class of bug. The advisory does not state the attack vector, required privileges, or whether a local or physical device is needed to trigger it. The fix moves cancellation of rumble and mode switch work into steam_unregister, closes the client HID device earlier in steam_remove, and clears client_opened under a spinlock. The advisory does not state affected or fixed kernel version numbers, a CVSS score, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/81a8209c09f9be7…0ca6cc154749a6b4d243 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-98944	In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98944In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow Executive summary The advisory describes a change to the Linux kernel's Steam controller driver (hid-steam) that refactors how the device registers and unregisters. It does not describe an exploitable security flaw, and it does not state a severity rating. The change also fixes a leftover power supply object that could remain after the device is torn down. Technical summary The advisory is a stable-tree commit titled 'HID: steam: Refactor registration' that simplifies the registration flow in drivers/hid/hid-steam.c and adds a registered boolean. It states that a battery unregistration step was previously omitted when later registration steps failed, leaving a lingering power_supply object, and that this is fixed. No vulnerability class, attack vector, or preconditions are stated, and the advisory does not describe a memory corruption, privilege escalation, or other security impact. Affected kernel versions are not stated, and fixed versions are not stated beyond this commit identifier. No CVSS score, workaround, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2b15e10aff95c78…4fa32fa90c9098213e03 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98943	In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98943In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU... Executive summary The advisory describes a fix in the Linux kernel's HID Steam driver (hid-steam.c) that cleans up locking, including RCU accesses that were not protected by a lock. It does not state how severe the issue is or whether it can be exploited, and it does not give a CVSS score. The advisory gives no vendor recommendation beyond applying the stable tree commit that carries the change. Technical summary The advisory is a kernel stable-tree commit titled 'HID: steam: Clean up locking' that addresses several locking problems, including RCU accesses not guarded by a lock; the vulnerability class is not stated beyond this. The attack vector and preconditions are not stated. The affected and fixed version numbers are not stated, though the commit identifier 6bce4b221dc0e144180c333123dbb82d1dc3a500 and upstream commit de1d341b9b3ec9655f31fb8b44f784cca5e670ad are given. No workaround and no detection guidance are stated. The change adds a registration_mutex, moves report_mutex handling, and alters spinlock use in the steam_raw_event and battery event paths. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/6bce4b221dc0e14…333123dbb82d1dc3a500 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98942	In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98942In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid... Executive summary The advisory describes a fix in the Linux kernel's sched_ext scheduler, where internal CPU identifier tables could be read by BPF programs while they were still being built or modified, potentially exposing unfilled or uninitialized memory. The advisory does not state how severe the issue is, and it does not state a CVSS score. It describes the change that resolves the issue but does not give specific recommended actions for administrators. Technical summary The flaw is a race condition: the cid (CPU identifier) tables used by sched_ext kfuncs were visible to TRACING or SYSCALL BPF programs while being filled or rewritten in place, so a racing reader could see unfilled entries, uninitialized kmalloc memory, or torn topology updates. The fix builds the tables privately per root scheduler enable and publishes them through RCU globals, unpublishing and RCU-freeing them on root disable. scx_bpf_this_cid() and scx_bpf_task_cid() were changed to add the needed RCU or preemption protection. The advisory does not state attack vector requirements beyond the racing BPF program described, does not give affected or fixed version numbers, does not state any workaround, and does not provide detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.0	CVE-2026-98941	In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 ("ext4: add checks for large... LinuxLinux, Linux kernel, Linux ext4	NVD	Oct 23 13:17 UTC
CVE-2026-98941In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 ("ext4: add checks for large... Executive summary A flaw in the Linux kernel's ext4 filesystem can cause a crash when encrypted data is written, if the encrypt feature is enabled on a filesystem that is already mounted. The advisory describes it as a NULL pointer dereference that crashes the kernel; it does not state a severity score. The fix disables large folios on encrypted files, which the advisory presents as the resolution. Technical summary The weakness is a kernel NULL pointer dereference in ext4 I/O completion, triggered when writing encrypted data after the encrypt feature is enabled on a mounted filesystem, which bypasses a mount-time check added by commit 709f0f1f1bf5. The advisory says the crash occurs in ext4_finish_bio via the ext4-rsv-conversion workqueue. The fix is in ext4_set_inode_mapping_order, which now also sets max_order to min_order for inodes with the EXT4_INODE_ENCRYPT flag. The advisory says it affects kernels between v6.19 and v7.2 and is not needed in v7.3. Attack vector, required privileges, and CVSS score are not stated. Workarounds and detection guidance are not stated beyond the kernel patch. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/40554d1221e3d2f…192b74a05d89eb3620e7 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel Linux ext4 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98940	In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98940In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and... Executive summary A fix in the Linux kernel's Qualcomm LPASS audio driver (ASoC) corrects an incorrect array index that could write beyond the intended audio DAI entry on some platforms. The advisory does not state how severe the issue is or whether it can be exploited, and it describes the change as a fix to a bug in the kernel stable tree. Technical summary The flaw is an incorrect table index in the lpass-cpu platform probe code, where dai_id (a hardware port ID) was used to index variant->dai_driver instead of the loop index i, so on platforms with sparse DAI IDs such as the IPQ806x MI2S DAI (ID 4) the code could write past the single table entry when configuring LPAIF_I2SCTL_MODE_QUAD01 playback channel constraints. The advisory does not state an attack vector, required privileges, or whether it can be triggered by an unprivileged user. The fix is the change from dai_driver[dai_id] to dai_driver[i] in sound/soc/qcom/lpass-cpu.c, and it references the commit introducing the issue (Fixes: c223f41c1a52). Affected and fixed kernel version ranges are not stated beyond the commit reference, and no workaround or detection guidance is provided. The advisory names no specific vulnerable product version and does not give a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/6833f1893ac2ec4…348779af63debf3700d2 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98939	In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98939In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a... Executive summary A fix in the Linux kernel's x86 memory management code removes an unnecessary memory allocation that could cause a possible deadlock when the system reclaims memory on a machine with a discrete GPU. The advisory does not state a severity rating or any impact beyond the lockdep warning described. The advisory describes a code change and does not give a clear recommendation to administrators beyond the fix itself. Technical summary The advisory describes a lock-ordering problem in the x86 huge vmap code, where a GFP_KERNEL allocation was made while holding the init_mm mmap read lock, which could create a circular dependency with memory reclaim. The fix removes the PMD page copy when freeing page table entries, detaching the original PMD page and freeing PTE tables from it instead. The advisory does not state attack vector, exploitation preconditions, CVSS score, affected or fixed kernel versions, workarounds, or detection guidance. The lockdep splat shows kernel version 7.3.0-rc3 as an example from the reporter's system, but the advisory does not explicitly list affected version ranges. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98938	In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rust: devres: fix... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98938In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rust: devres: fix... Executive summary This advisory concerns a fix in the Linux kernel's Rust IRQ registration code, where an interrupt callback could read uninitialized memory during device setup. The advisory does not state a severity rating, and it describes the change as a stable tree fix rather than an exploitation report. Technical summary The flaw is a use of uninitialized memory: after commit ba268514ea14 changed Devres::new() to return the value directly, request_irq() could run before registration.inner was initialized, so an IRQ callback could read uninitialized data when accessing the device. The fix stores the Device and handler pointer in RegistrationInner and passes RegistrationInner as the IRQ cookie after its fields are initialized. The advisory does not state the attack vector, required privileges, or exploitability, nor any CVSS score. Affected and fixed version numbers are not stated as ranges; the commit is identified only by its hash 9a7931e847f338a687e96cde9f37e0cff83ddd84 and dated 2026-10-07 for the author and 2026-10-11 for the committer. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/9a7931e847f338a…6cde9f37e0cff83ddd84 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98937	In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98937In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates... Executive summary The advisory describes a flaw in the Linux kernel's perf performance profiling subsystem, where users can request kernel callchain collection without the kernel profiling privilege that should be required. The advisory does not state a severity rating, and it describes the change as preventing unprivileged use of kernel callchain capture. The advisory provides a kernel patch from the stable tree as the fix, and no other recommendation is stated. Technical summary This is an improper permission check issue in the Linux kernel perf_event_open() syscall. The check called perf_allow_kernel() only when attr.exclude_kernel was not set, so a caller with exclude_kernel set but exclude_callchain_kernel cleared could capture kernel callchains without kernel profiling privilege. The fix extends the check to also call perf_allow_kernel() when PERF_SAMPLE_CALLCHAIN is set and exclude_callchain_kernel is zero. Affected and fixed kernel version numbers are not stated in the advisory, and no workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/132bee76097be42…12130b5b506324cf2be1 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98936	In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple) hw restart occurs, we end up in a... Linux, Qualcomm, Inc.Linux, Linux kernel, Qualcomm, Inc. ath11k	NVD	Oct 23 13:17 UTC
CVE-2026-98936In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple) hw restart occurs, we end up in a... Executive summary This advisory concerns a Linux kernel fix in the ath11k Wi-Fi driver for Qualcomm devices. After repeated hardware restarts, the driver could wrongly refuse new Wi-Fi station or mesh peer connections, and the fix resets the affected counter on hardware start. The advisory does not state a severity rating, and the fix is a kernel stable tree patch. Technical summary The flaw is a state-reset bug in the ath11k driver where the num_stations counter in struct ath11k was not cleared in ath11k_mac_op_start() during hardware restart, causing the driver to refuse new station associations with a 'too many connected already' error. The advisory describes the trigger as multiple hardware restarts, with no remote attack vector or privilege requirements stated. The patch adds a single line setting ar->num_stations to 0 in drivers/net/wireless/ath/ath11k/mac.c, and the commit references the Fixes tag d5c65159f289. No affected or fixed kernel version ranges, CVSS score, workaround, or exploitation status are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/60142eb2afda345…0a3ff2a54c90e51525cc Score No CVSS score published. Affects Linux Qualcomm, Inc.Linux Linux kernel Qualcomm, Inc. ath11k NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98935	In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak The struct rtc_wkalrm has padding... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98935In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak The struct rtc_wkalrm has padding... Executive summary The advisory concerns the Linux kernel real-time clock (RTC) device interface, where uninitialized kernel memory could be returned to user programs. The advisory describes this as an information leak fix and does not state a severity rating. The fix is a one-line change that zero-initializes the affected structure, as shown in the stable kernel commit. Technical summary The flaw is an information leak caused by uninitialized kernel stack data in padding holes of struct rtc_wkalrm, which is returned to userspace through the RTC_WKALRM_RD ioctl in rtc_dev_ioctl. The advisory does not state the attack vector or privileges required to reach the ioctl. The fix zero-initializes the struct at declaration in drivers/rtc/dev.c, and the upstream commit is 0ee5c5d804d592a8328a425b9274487d393d3a05. Affected and fixed kernel version ranges are not stated in the advisory. No workaround is stated. No detection guidance is stated, and the advisory does not say whether exploitation has been observed or give a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/00dc50cede96738…4b20e671186cddb8a58d Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98934	In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector:... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98934In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector:... Executive summary The advisory describes a flaw in the Linux kernel's IPv6 segment routing code, where a flow hash calculation can hit a warning when the packet has no associated network device or socket. The advisory does not state a severity rating, and it does not describe the outcome beyond the kernel warning shown in the trace. No fix version or vendor recommendation is stated in the text provided. Technical summary The flaw is in seg6_make_flowlabel(), which calls skb_get_hash() without a network namespace pointer, causing a WARNING in __skb_flow_dissect when the skb has neither skb->dev nor skb->sk set. The advisory says syzbot reached it through a TIPC UDP bearer sending a discovery message over an IPv4 route using seg6 encapsulation, with net.ipv6.seg6_flowlabel set to 1. The fix is to use skb_get_hash_net() with the namespace pointer that the function already has. The advisory does not state the affected or fixed kernel versions, a CVSS score, a workaround, or any detection guidance beyond the trace. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98933	In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for... Linux, AMDLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98933In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for... Executive summary This advisory concerns a Linux kernel USB hub change that shortens a post-resume hold time for USB3 root hubs. It describes the change as a mitigation for a crash seen on an AMD platform when Android adb repeatedly wakes the USB subsystem, and it is presented as a fix in the stable kernel tree. The advisory does not state a severity rating, and it recommends the change in the kernel source as shown, with vendors still said to be working on a full solution. Technical summary The flaw is described as a platform issue triggered by holding a USB3 hub runtime power management reference for 200ms during hub resume, which the advisory says causes crashes after repeated adb polling. The fix reduces the hold to 120ms for USB3 root hubs in drivers/usb/core/hub.c while keeping 200ms for external hubs, and it is tied to commit 8f5b7e2bec1c. The advisory does not state the attack vector, required privileges, or exploitation status. No affected or fixed kernel version numbers, CVSS score, workaround details beyond disabling USB runtime PM, or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/29480b05e6e2265…1ccf2a036fbd5cdd0e42 Score No CVSS score published. Affects Linux AMD Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.4	CVE-2026-98932	In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(),... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98932In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(),... Executive summary A use-after-free bug in the Linux kernel's Altera EDAC (error detection and correction) driver was fixed in the stable tree. The advisory describes it as a memory-safety flaw in error-handling paths and does not state a severity score or any exploitation details. Technical summary The flaw is a use-after-free in the Linux kernel EDAC/altera driver, in altr_edac_a10_device_add() and altr_portb_setup(). The error paths freed the dci structure before releasing the devres group, so a managed single or double bit IRQ firing in that window could dereference freed memory through the handler data. The fix releases the devres group first so managed IRQs are unregistered before dci is freed. The advisory does not state a CVSS score, attack vector or required privileges, exploitation status, or a workaround. Affected version ranges are not stated beyond the commit being tagged for stable branches 6.18 and later. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/865f3bdebbc9b34…8c377c9b15154f95f33b Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98931	In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT,... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98931In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT,... Executive summary A flaw in the Linux kernel's SPI-NAND driver (mtd: spinand) can crash the system when a device is configured with the "nand-no-ecc-engine" device tree setting. The advisory describes this as a NULL pointer dereference that causes an oops when such a device is probed. The advisory does not state a severity rating, and it indicates a fix has been committed to the Linux kernel stable tree. Technical summary This is a NULL pointer dereference in the Linux kernel's mtd SPI-NAND code (drivers/mtd/nand/spi/core.c). When "nand-no-ecc-engine" is set in the device tree, nanddev_get_ecc_engine() returns success with nand->ecc.engine left NULL, and spinand_create_dirmap() dereferences it unconditionally, so probing such a device oopses immediately. The fix adds a NULL guard before the pipelined-integration comparison in spinand_create_dirmap(). The advisory does not state the attack vector, required privileges, or CVSS score, and it does not state affected or fixed kernel version numbers beyond the commit reference. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3c765fd5212c1bb…8b1518a7ec963a7040b4 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98930	In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98930In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a... Executive summary This advisory describes a fix in the Linux kernel's KVM virtualization code for IBM s390 systems. A flaw in how a Stop and Store Status operation injected interrupts could cause a write to userspace while a spinlock was held, which the advisory treats as a problem. The advisory does not state a severity rating or any exploitation details. Technical summary The advisory describes a fix in arch/s390/kvm/interrupt.c where __inject_sigp_stop() could call kvm_s390_store_status_unloaded(), which writes into userspace and might fault, while a spinlock was held via do_inject_vcpu(). The fix returns -EWOULDBLOCK and a bool flag so the store status is performed outside the spinlock. The advisory identifies the Fixes tag as 6cddd432e3da, and it does not state affected or fixed version numbers, a CVSS score, attack vector or required privileges, workarounds, or detection guidance. The advisory is a stable-tree commit page and does not state whether the issue has been exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3bd77c59576b1d4…6cc689ae9523a334b924 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98929	In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98929In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an... Executive summary The advisory covers a flaw in the Linux kernel's MACsec network driver, where a MACsec device created with MAC offload over an LRO-capable lower device could trigger a kernel warning because its security settings were not initialized before the network device was registered. The advisory describes the issue as a fix to initialization ordering and does not state a severity rating. The fix is a kernel patch that moves setup steps ahead of device registration, and the advisory does not describe any other vendor recommendation. Technical summary The weakness is an initialization ordering bug in the macsec driver: the SecY was set up after register_netdevice(), so notifications emitted during registration could read zero key length and uninitialized SCI values, causing a WARN_ON in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled. The advisory says the issue has existed since the driver was introduced and references the commit that introduced it. The fix initializes the SecY and applies new-link attributes before registration, moves MAC address inheritance into macsec_newlink(), and allocates per-CPU statistics and metadata destination in ndo_init() with cleanup on failure. The advisory does not state an attack vector, required privileges, or exploitation status beyond the syzbot report reference, and it does not state affected or fixed version numbers, a CVSS score, or workarounds. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2b42adf3b8ee9a0…29aca3c5a02a1c438066 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98928	In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98928In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes... Executive summary The advisory describes a fix in the Linux kernel's KVM virtualization code for arm64 systems. It does not state how severe the flaw is, and it does not give a CVSS score or exploitation status. The advisory does not name any vendor product beyond the Linux kernel. Technical summary The flaw is in the arm64 KVM protected-mode initialization path, where a host could set the GUEST_HAS_SVE flag without the matching SVE feature bit, leading to a vCPU with a NULL sve_state that the world switch loads guest SVE state from. The fix derives the flag from the SVE feature bit and removes dead code in the protected path. The advisory states the affected kernel versions only through the upstream fix commit and Fixes tag (commit 41d6028e28bd), and does not give an explicit list of affected or fixed version numbers. Attack vector, required privileges, and exploitability are not stated. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/4efda204087145d…344edec7e9d3885ad3ab Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.0	CVE-2026-98927	In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98927In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables... Executive summary The advisory describes a flaw in the Linux kernel's KVM virtualization support for arm64 systems, in how nested virtual machine shadow page table structures are allocated and freed. The advisory does not state how serious the flaw is, and it does not state a CVSS score or exploitation status. The fix is a kernel patch merged into the stable tree, and the advisory does not describe any other recommended action. Technical summary The flaw is a life cycle (use-after-free style) bug in the nested_mmus array used for nested Stage-2 shadow page tables in KVM on arm64. The advisory says a VCPU_INIT issued while a vCPU is running an L2 guest can relocate the array, leaving that vCPU with a pointer to freed memory. The fix changes the array to pointers allocated at VM creation and sized to the maximum, with s2_mmu structures allocated on VCPU_INIT and freed in kvm_arch_flush_shadow_all(). The advisory does not state affected or fixed version numbers, attack vector details beyond the VCPU_INIT condition, privilege requirements, or workarounds. It gives no detection guidance and does not state a CVSS score or whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/33346f8960c7bb6…273b5cfe25c5a8be349f Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98926	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should... Linux, AMDLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98926In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should... Executive summary This advisory concerns a change to the AMD display driver in the Linux kernel. The advisory describes a code change that removes a possibly null pointer dereference in the display power-management (DPMS) code, and it does not state a severity rating or any exploitation details. Technical summary The advisory describes a fix in the amd/display driver, where stream->sink is optional and can be null but was dereferenced in DPMS on and off sequences; the patch replaces stream->sink->link with stream->link and adds null checks and ASSERT calls. The advisory does not state a vulnerability class in those words, an attack vector, or required preconditions. Affected and fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is given. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0b1eebd359685dd…e0df5540a5bb985a27bf Score No CVSS score published. Affects Linux AMD Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98925	In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98925In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an... Executive summary A flaw in the Linux kernel's BPF sockmap code can cause TCP receive sequence counters to be advanced twice when a BPF program redirects traffic back to the same socket. The advisory describes kernel warnings triggered by this condition, and it does not state a severity rating. The advisory describes a kernel code fix but does not state any vendor recommendation beyond that fix. Technical summary The vulnerability is a double-counting error in the Linux kernel's BPF sockmap self-redirect path, where tcp_eat_skb() and the copied_from_self accounting in tcp_bpf_recvmsg_parser() both advance tcp_sk->copied_seq, producing kernel warnings in tcp_recvmsg_locked and tcp_cleanup_rbuf. The attack vector and required privileges are not stated, though the trigger is a BPF stream_verdict program that redirects an skb to the same socket with BPF_F_INGRESS. The fix converts self-redirect verdicts to __SK_PASS at the start of sk_psock_verdict_apply(), while cross-socket redirects keep the existing __SK_REDIRECT path. Affected and fixed kernel version numbers are not stated in the advisory, and no workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98924	In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98924In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a... Executive summary A flaw in the Linux kernel's filesystem inode eviction code can cause long stalls when a filesystem is unmounted after its disk was removed while still in use. The advisory says this can trigger hung-task reports and block concurrent unmount attempts. The advisory does not state a severity rating or a CVSS score. Technical summary The flaw is a resource-handling problem in fs evict_inodes(): each time the walk drops s_inode_list_lock to reschedule, it restarts from the head of s_inodes and rescans referenced inodes without reclaiming them, holding s_umount for a long time during device removal. The advisory describes a local trigger (unmounting a filesystem whose disk was removed while in use) and does not describe a remote attack vector. The fix keeps the current I_FREEING inode out of the disposal batch and resumes the walk from it after the lock is reacquired. Affected kernel versions, fixed versions, workarounds, and detection guidance are not stated in the advisory. Testing reportedly used the xfstests auto group on ext4 and XFS with no new issues observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98923	In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98923In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with... Executive summary A fix in the Linux kernel's arm64 memory mapping code corrects a spurious kernel warning that can be triggered when a process's memory is read through /dev/mem and /proc. The advisory describes this as a kernel stable tree commit that makes the access fail cleanly for PROT_NONE and execute-only mappings, and it does not state a severity rating. The advisory does not describe a remote attack path or a recommended action beyond applying the upstream stable kernel fix. Technical summary The flaw is a spurious WARN_ON_ONCE in the arm64 ioremap_prot() function, reached through generic_access_phys() when a PROT_NONE or execute-only user mapping is accessed via /dev/mem and /proc/<pid>/cmdline. The fix changes ioremap_prot() to return NULL without a warning when protection values lack PTE_USER, so the access fails cleanly. The advisory names the fixing commit as bb756b11ad63832ebee58caf9e8f9381eaecff9f in the stable tree, and the Fixes tag references 8f098037139b. Affected and fixed kernel version ranges are not stated, and no CVSS score, exploitation status, or workaround is stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0b04af3d88bb7fc…92457890608860e42365 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98922	In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: \|BUG:... LinuxLinux, Linux kernel, Linux emac	NVD	Oct 23 13:17 UTC
CVE-2026-98922In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: \|BUG:... Executive summary A kernel bug in the Linux emac network driver causes a crash when the driver starts up on some devices, which can stop the system from booting or working normally. The advisory does not state a severity rating, and it does not describe any remote attack or known exploitation. The text describes a code fix that moves some driver setup earlier, but it does not give a specific fixed version or a formal vendor recommendation. Technical summary This is a NULL pointer dereference in the Linux kernel emac network driver, triggered during driver initialization. The crash occurs in phy_link_topo_add_phy() because of_phy_connect() runs before netdev_ops are set, and the regression is said to have started at v7.3-rc1 after commit ded86da4bbb7. The fix moves setting of netdev_ops, commac.ops, and ethtool_ops earlier in emac_probe, and the advisory says the dev->commac.ops assignment for the non-GigE case moves into an else block. The advisory does not state a CVSS score, a fixed kernel version number, a workaround, or any detection guidance, and it does not state an attack vector because the crash is a local initialization fault. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel Linux emac NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98921	In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98921In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after... Executive summary A use-after-free bug was fixed in the Linux kernel's overlay filesystem (overlayfs) debug logging for directory creation. The advisory does not state how severe the flaw is or whether it can be exploited by an attacker, and it describes the fix only as a correction to a debug print that could access freed memory. Based on the text, the recommended action is to apply the upstream stable kernel fix. Technical summary The flaw is a use-after-free in ovl_do_mkdir() in fs/overlayfs/overlayfs.h, caused by printing the dentry with %pd after vfs_mkdir() had already released or replaced it on failure or success. The issue only occurs when CONFIG_OVERLAY_FS_DEBUG is enabled, per the advisory. The fix prints the dentry before the call and only the result afterward. The advisory does not state the affected or fixed kernel version numbers, the attack vector, required privileges, a CVSS score, or any workaround. It also does not state whether the bug was exploited in the wild. The commit was reported by syzbot and references commit fe497f0759e0 as the change that introduced the problem. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/719bd33ab359c53…278c15a97deb77565cdb Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98920	In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98920In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix... Executive summary The advisory describes a fix in the Linux kernel's netfs networking filesystem code, where some memory allocations were not properly tagged for kernel memory profiling. It does not state how serious the issue is, and it does not describe a security impact such as data exposure or privilege escalation. The advisory describes the fix but does not state any vendor recommendation beyond the patch itself. Technical summary The flaw is a missing allocation tag in the netfs subsystem: mempool allocations made directly through the pool's alloc callback skip the alloc_hooks() wrapper, so current->alloc_tag is unset. The advisory reports kernel warnings at allocation and free time with CONFIG_MEM_ALLOC_PROFILING_DEBUG=y when reading files on a CIFS mount, and says the allocations are missing from /proc/allocinfo. The fix wraps these direct calls in alloc_hooks() through a new mempool_alloc_noreserve() helper in include/linux/mempool.h. The advisory does not state a CVSS score, attack vector, required privileges, affected version ranges, fixed version numbers, workarounds, or whether exploitation has occurred. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98919	In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98919In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several... Executive summary The advisory describes a fix in the Linux kernel's Intel Xe graphics driver (drm/xe), in the adjust_idledly() routine. The flaws could cause a kernel divide-by-zero panic or a repeated warning during GPU initialization. The advisory does not state a severity rating, and it describes the change as a hardening fix that the kernel maintainers have already committed. Technical summary The flaws are a divide-by-zero, 32-bit integer overflow, and a wraparound of the maxcnt minus one clamp in adjust_idledly() in the drm/xe driver. A divide-by-zero occurs when gt->info.timestamp_base is 0, which the advisory says happens when xe_gt_clock_init() does not recognise the crystal clock. The fix returns early on a zero timestamp_base, performs conversions in u64, clamps with DIV_ROUND_DOWN_ULL, and writes RING_IDLEDLY using REG_FIELD_PREP(IDLE_DELAY, ...). The advisory does not state attack vector, required privileges, or exploitation status. Affected and fixed product versions are not stated, and no CVSS score or workaround is stated. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98918	In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check()... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98918In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check()... Executive summary A flaw in the Linux kernel's DAMON memory monitoring code on arm64 systems can cause the kernel to write past the end of a page table page, which may crash the system or silently corrupt memory owned by another process. The advisory reports crashes seen while running the kernel selftest suite on arm64 EC2 instances. The advisory does not state a severity score, and the fix described is a change to the kernel code that aligns an address before use. Technical summary The issue is a memory write overrun in the DAMON access-sampling path (damon_ptep_mkold), where an unaligned address is passed to the arm64 contpte helper, causing it to clear PTE_AF in entries beyond the sampled block and possibly past the end of a page table page. The consequence can be a kernel crash on a read-only following page or silent memory corruption otherwise. The advisory does not state the attack vector, required privileges, or CVSS score, and it does not state affected or fixed kernel version numbers beyond referring to commit 6f0e1142173a as the change that introduced the behavior. The described fix is to pass a page-aligned address to ptep_test_and_clear_young() in damon_ptep_mkold(). No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: ARM arm64 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-98917	In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack... LinuxLinux, Linux kernel	NVD	Oct 23 13:17 UTC
CVE-2026-98917In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack... Executive summary This advisory describes a change to the Linux kernel for PA-RISC systems that increases the default kernel stack size to 32 kB on 64-bit kernels. The advisory does not describe an exploitable security flaw, and it does not state a severity rating or an attack vector. Technical summary The change raises the kernel stack size (THREAD_SIZE_ORDER) to 32 kB for 64-bit parisc kernels, in order to avoid kernel panics caused by low stack detection while building a Debian package with gcc 17. The described problem is a stack overflow that triggers a kernel panic, and the advisory does not state an exploit path, attacker preconditions, or attack vector. The diff changes arch/parisc/include/asm/thread_info.h so that the 16 kB size remains for non-64-bit configurations. The advisory does not state a CVSS score, a CVE-specific weakness classification, affected kernel version ranges beyond the stable backport note 'v6.18+', a workaround, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/5023c70853ad982…8e9def5ee969b4e1b931 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.4	CVE-2026-63120	pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores Aiven-Open, pghoardAiven-Open pghoard, pghoard	NVD	Oct 23 13:17 UTC
CVE-2026-63120pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores Executive summary An incomplete fix for a path traversal flaw in pghoard, a PostgreSQL backup tool, lets an attacker who can write to the backup storage place files anywhere on the restoring host. The advisory rates it High, with a CVSS score of 8.4. The vendor recommends upgrading to version 2.7.2, which is not yet described as released at the time of the advisory, and states there are no workarounds. Technical summary The flaw is CWE-22 path traversal in restore.py, where an incomplete earlier fix still lets a crafted delta backup manifest write files and create directories outside the PostgreSQL data directory. The attacker needs write access to the backup object store (such as S3, GCS, or Azure), and the write happens when a database administrator runs pghoard_restore get-basebackup. Affected versions are stated as up to and including 2.7.1, and the patched version is stated as 2.7.2. The advisory states there are no known workarounds, and it gives CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H with a base score of 8.4. Exploitation in the wild, specific detection guidance, and the exact release date of 2.7.2 are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Aiven-Open/pghoard/security/…/GHSA-rh99-q79h-vvx3 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Affects Aiven-Open pghoard Aiven-Open pghoard pghoard NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.0	CVE-2026-57210	Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service dadrusdadrus heimdall	NVD	Oct 23 13:17 UTC
CVE-2026-57210Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service Executive summary Heimdall, a cloud native identity-aware proxy and access control decision service, has a flaw that lets attackers spoof client IP addresses by sending crafted forwarding headers. The advisory rates it High with a CVSS v4 base score of 7.0, and affects Heimdall versions up to and including 0.17.16. The fix is to upgrade to version 0.17.17, and the advisory recommends sanitizing forwarding headers at the proxy and avoiding reliance on client IP values for security decisions until patched. Technical summary The flaw is improper input validation of the Forwarded (for= parameter) and X-Forwarded-For headers when the trusted_proxies option is configured, so arbitrary, malformed, or obfuscated values are stored in Request.ClientIPAddresses. The Forwarded parser also splits on commas and semicolons without handling RFC 7239 quoted strings, creating extra malformed entries. The CVSS v4 vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N, so the attack is network-reachable with no privileges or user interaction, and exploitation requires trusted_proxies to be set and, for rule-based scenarios, rules that reference the property. Affected versions are stated as less than or equal to 0.17.16 and the patched version is 0.17.17. The advisory's workarounds are to restrict direct access to heimdall to trusted proxies, have the front proxy overwrite rather than append forwarding headers, and avoid security decisions based on Request.ClientIPAddresses until patched. Exploitation in the wild and specific detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/dadrus/heimdall/security/adv…/GHSA-38x9-25wx-7fg2 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dadrus dadrus heimdall NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.0	CVE-2026-57209	Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service dadrusdadrus heimdall	NVD	Oct 23 13:17 UTC
CVE-2026-57209Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service Executive summary Heimdall, a cloud native identity-aware proxy and access control service, has a flaw that lets an attacker inject fake client IP information into the Forwarded header when it runs in proxy mode. The advisory rates it High with a CVSS v4 base score of 7.0, and it can lead to bypassing IP-based access restrictions on upstream applications. The advisory says the fix is to upgrade to version 0.17.17 or later. Technical summary The flaw is an improper input validation and injection issue (CWE-20, CWE-74) where Heimdall copies the incoming Host header into the Forwarded header without removing commas or semicolons. A remote, unauthenticated attacker can send a crafted Host header to proxy-mode deployments, with no user interaction needed, to add a spoofed for= value that upstream services may trust. Affected versions are stated as 0.17.16 and earlier, and the patched version is 0.17.17. The advisory does not state any workaround. It does not state whether the flaw has been exploited in the wild. Detection guidance beyond the proof-of-concept requests is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/dadrus/heimdall/security/adv…/GHSA-4jgr-pg2m-m988 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dadrus dadrus heimdall NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-57146	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 13:17 UTC
CVE-2026-57146PraisonAI is a multi-agent teams system Executive summary A flaw in the PraisonAI multi-agent system's A2U event server lets anyone who can reach the server subscribe to agent event streams without credentials when it is started with the documented praisonai serve a2u command and no A2U_AUTH_TOKEN is set. The advisory rates it High with a suggested CVSS v3.1 score of 7.5, and states that the prior fix in GHSA-f292-66h9-fpmf does not cover this command path. The advisory recommends secure-by-default authentication for the A2U command, token support on the command line, and refusing external binds without authentication, and it notes that the affected range should not be marked as fixed. Technical summary This is a missing authentication issue (CWE-306) with related sensitive information exposure (CWE-200) in the PraisonAI A2U server, affecting pip package praisonai versions >= 4.5.115, <= 4.6.58 as stated in the advisory, with patched versions listed as >= 4.6.61. The attack vector is network access to the A2U server, which the advisory says is started with praisonai serve a2u --host 0.0.0.0 --port 8002, with low complexity and no privileges or user interaction required. Authentication is only enforced if the A2U_AUTH_TOKEN environment variable is set before startup; otherwise the subscribe, event stream, info, and health routes accept unauthenticated requests, and the CLI does not offer --api-key or generate a token. The advisory's proof-of-concept output shows HTTP 200 responses without credentials when no token is configured and 401 when a token is configured. No workaround beyond setting A2U_AUTH_TOKEN is described in the advisory as an official fix, and whether a vendor-issued patch resolves this is not stated. Detection guidance beyond the proof-of-concept is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-jxcw-qp4h-6jfq Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-57144	PraisonAI is a multi-agent teams system MervinPraison, PraisonAIMervinPraison PraisonAI, praisonai	NVD	Oct 23 13:17 UTC
CVE-2026-57144PraisonAI is a multi-agent teams system Executive summary PraisonAI, a multi-agent teams system, has a flaw in its Sandlock sandbox that can let code run outside its intended isolation when the kernel feature Landlock is unavailable. The advisory rates it High, with a suggested CVSS 3.1 score of 8.8 and a suggested severity of High. The advisory states that no fixed version is known at submission time, and its suggested fix is to make the sandbox fail closed instead of falling back to unrestricted execution. Technical summary The flaw is a protection mechanism failure (CWE-693) in praisonai.sandbox.SandlockSandbox. When the optional sandlock module reports that Landlock is unavailable, execute() and run_command() silently fall back to SubprocessSandbox, which does not enforce the configured filesystem allowlist or network=False setting. The advisory's proof of concept showed code reading a file outside the allowed path and connecting to a localhost listener. Attack vector is local with low privileges required, and the advisory lists the affected range as >= 4.5.110, <= 4.6.58, with patched versions stated as >= 4.6.61 in the package metadata. Workarounds are not stated beyond the suggested fix of failing closed or requiring explicit opt-in for degraded fallback. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-6jcq-6546-qrrw Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects MervinPraison PraisonAI MervinPraison PraisonAI praisonai NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.8	CVE-2026-57142	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 13:17 UTC
CVE-2026-57142PraisonAI is a multi-agent teams system Executive summary A flaw in PraisonAI, a multi-agent teams system, lets an untrusted recipe bypass the dangerous-tool policy and self-approve the critical execute_command shell tool without the operator enabling allow_dangerous_tools. The affected range is stated as 4.5.87 through 4.6.57, and the advisory rates it High with a CVSS 3.1 score of 7.8. The advisory says the fix is version 4.6.61 or later. Technical summary The weakness is an authorization bypass (CWE-863) that can lead to OS command injection and code injection (CWE-78, CWE-94). The recipe dangerous-tool check reads only TEMPLATE.yaml requires.tools, while steps-based workflows load workflow.yaml agents.*.tools and top-level approve:, which marks the tool as approved. Exploitation requires an operator to run an untrusted recipe or expose the recipe runner to users who choose recipe names or URIs, and the advisory says user interaction is required. Affected versions are stated as >= 4.5.87, <= 4.6.57, and patched versions as >= 4.6.61. The advisory suggests parsing the workflow tool graph before the policy check and treating approve: as operator-supplied, but it does not describe a workaround for deployed systems. Detection guidance beyond the proof-of-concept reproduction is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-7qw2-w5rc-37x2 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-57121	PraisonAI is a multi-agent teams system MervinPraison, PraisonAIMervinPraison PraisonAI, praisonai-platform	NVD	Oct 23 13:17 UTC
CVE-2026-57121PraisonAI is a multi-agent teams system Executive summary A flaw in PraisonAI's Platform API lets any workspace member permanently delete content created by the workspace owner or other members, including projects, agents, issues, and labels. The advisory rates it High, with a CVSS v3.1 base score of 8.1. The advisory says affected versions are >=0.1.4 and the patched version is >= 0.1.5, so the recommended action is to upgrade praisonai-platform to 0.1.5 or later. Technical summary This is an improper authorization flaw (CWE-285) in which DELETE endpoints for six content resource types check workspace membership but not ownership or role, so any member can delete others' content. The attack requires a valid member account in the target workspace, with network access and low privileges and no user interaction, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Affected versions are stated as >=0.1.4 and patched versions as >= 0.1.5. The advisory does not state any workaround, and it does not state whether the flaw has been exploited in the wild. Detection guidance such as log indicators is not stated; the advisory gives only a proof of concept showing a 204 response to a member's DELETE request where a 403 was expected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-rh39-9c67-59mh Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Affects MervinPraison PraisonAI MervinPraison PraisonAI praisonai-platform NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-57117	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 13:17 UTC
CVE-2026-57117PraisonAI is a multi-agent teams system Executive summary A flaw in PraisonAI, a multi-agent teams system, lets someone who can influence a file path argument run arbitrary shell commands when compute bridging is enabled. The advisory rates it High, with a CVSS v3.1 score of 8.8, and the affected range is versions 4.6.10 through 4.6.57. The advisory recommends moving file operations to provider-native APIs or structured arguments, and as a stopgap, removing read_file, list_files, and write_file from the compute-bridged tool set; it names the patched version as 4.6.59 or later. Technical summary This is an OS command injection flaw (CWE-78, with secondary CWE-863) in the compute-bridged file tools of managed_local.py. Raw path and content arguments are placed into shell command strings for read_file, list_files, and write_file, so a crafted path can break out of quotes and execute commands in the local subprocess or Docker compute environment. The advisory states the attack vector as network with low privileges required and no user interaction, and notes that an unauthenticated deployment may justify PR:N. Affected versions are stated as >= 4.6.10 and <= 4.6.57, and patched versions as >= 4.6.59. Workarounds are given as removing the three file tools from compute_bridged_tools, and no detection guidance beyond the proof-of-concept canary test is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-w6h2-fr4q-xvxv Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-57116	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 13:17 UTC
CVE-2026-57116PraisonAI is a multi-agent teams system Executive summary The advisory says the PraisonAI AgentOS web deployment accepts requests without authentication, so any client that can reach it can list deployed agents and invoke them. The advisory rates this Critical with a suggested CVSS 3.1 score of 9.8, and states the affected range as >= 4.2.1, <= 4.6.57 with a patched version of >= 4.6.59. The advisory does not state a specific remediation for operators beyond the maintainer fix guidance, and it recommends that maintainers add authentication and bind to 127.0.0.1 by default. Technical summary The flaw is missing authentication (CWE-306, CWE-862) and possible exposure of sensitive information (CWE-200) in the AgentOS FastAPI routes GET /api/agents and POST /api/chat, which are reachable without a bearer token and which ignore wrong bearer tokens. The default host is 0.0.0.0, and the advisory says the attack requires only network reachability with no privileges or user interaction. The advisory lists the affected range as >= 4.2.1, <= 4.6.57 and the patched version as >= 4.6.59, and notes that the published patched version 4.5.128 for GHSA-pm96-6xpr-978x still reproduces. A local proof of concept is provided, and the advisory states no workaround is given beyond the suggested fix of enabling authentication and binding to 127.0.0.1. Detection guidance beyond the proof of concept is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-892r-p3jq-jp24 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.2	CVE-2026-57114	PraisonAI is a multi-agent teams system MervinPraison, PraisonAIMervinPraison PraisonAI, praisonai	NVD	Oct 23 13:17 UTC
CVE-2026-57114PraisonAI is a multi-agent teams system Executive summary PraisonAI's Jobs API can be tricked into sending webhook requests to internal or cloud metadata addresses that the code is supposed to block, using DNS rebinding. The advisory rates this High and says a patched version is not known at report time, so no fix version is stated. The advisory suggests moving address validation to the moment the outbound connection is made, along with other hardening steps. Technical summary This is a server-side request forgery (CWE-918) with a time-of-check to time-of-use weakness (CWE-367): webhook_url is validated once at submission using a resolved public address, but the stored hostname is resolved again when the webhook is sent, so a hostname can resolve to loopback or private addresses at delivery. The attack requires the attacker to submit jobs to a network-reachable Jobs API and control DNS for the webhook hostname; the advisory notes authentication is not required by default. Affected versions are stated as >= 4.5.126, <= 4.6.57, and the advisory states no patched version is known at report time, while the advisory's package metadata lists patched versions as >= 4.6.59. CVSS 3.1 is given as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N with a score of 7.2. Suggested fixes include validating all resolved addresses at send time, pinning the validated IP, and requiring authentication by default, and a local proof-of-concept is provided. Workarounds and vendor-issued detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-rjvw-7vvw-549v Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Affects MervinPraison PraisonAI MervinPraison PraisonAI praisonai NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-57113	PraisonAI is a multi-agent teams system MervinPraison, PraisonAIMervinPraison PraisonAI, praisonai	NVD	Oct 23 13:17 UTC
CVE-2026-57113PraisonAI is a multi-agent teams system Executive summary A path traversal flaw in PraisonAI's GitHub template cache lets a crafted template reference write files and delete directories outside the cache folder. The advisory rates it High, with a suggested CVSS 3.1 score of 8.1, and it says no fixed version is known at the time of the report. Technical summary This is a path traversal weakness (CWE-22, CWE-73) in cache-key construction for GitHub template URIs, where the ref and path segments are joined into a cache path without validation. An attacker who can get a user or service to load a crafted GitHub template URI, with a ref containing parent-directory sequences, can write .cache_meta.json outside the cache and, if a normal cache entry already exists for the same owner/repo/template, delete an attacker-selected directory via shutil.rmtree. The advisory states affected versions as >= 2.6.0, <= 4.6.57, with patched versions listed as >= 4.6.59, and also says no fixed version is known at the time of the report, so the fix status is ambiguous. Suggested workarounds are not stated beyond proposed code fixes, namely strict segment validation, a resolved-path boundary check, and hashing untrusted fields into directory names. No specific detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-f44v-7qgw-9gh9 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Affects MervinPraison PraisonAI MervinPraison PraisonAI praisonai NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.3	CVE-2026-55889	XDG Desktop Portal is a desktop integration portal flatpak, XDG Desktop Portalflatpak xdg-desktop-portal, XDG Desktop Portal	NVD	Oct 23 13:17 UTC
CVE-2026-55889XDG Desktop Portal is a desktop integration portal Executive summary The XDG Desktop Portal desktop integration component has security flaws that let sandboxed applications interfere with data or write files outside their sandbox. The advisory describes these as security fixes in release 1.22.1 and recommends updating to that release. The advisory does not state a severity score. Technical summary The advisory describes three security fixes: a predictable key in FileTransfer.RetrieveFiles that lets a malicious sandboxed application redirect drag-and-drop and copy-paste data to itself (GHSA-c5cf-79w8-pvfh), arbitrary write access to nonexistent files outside the sandbox via the files option in FileChooser.SaveFiles (GHSA-cm83-2936-gxjm), and unvalidated App IDs in the Document Portal that can cause arbitrary host files to be parsed as Glib.KeyFile objects (#2023). The vulnerability classes are not named beyond these descriptions, and the attack preconditions beyond a malicious sandboxed application are not stated. Affected version ranges are not stated, though the fixes are included in 1.22.1. No CVSS score, workaround, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/flatpak/xdg-desktop-portal/releases/tag/1.22.1 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects flatpak XDG Desktop Portal flatpak xdg-desktop-portal XDG Desktop Portal NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-55888	XDG Desktop Portal is a desktop integration portal flatpak, XDGflatpak xdg-desktop-portal, XDG Desktop Portal	NVD	Oct 23 13:17 UTC
CVE-2026-55888XDG Desktop Portal is a desktop integration portal Executive summary The advisory concerns XDG Desktop Portal, a desktop integration component, and describes several security fixes in release 1.22.1. The issues let sandboxed applications interfere with data transfers or write to or read files outside their sandbox. The advisory does not state a severity score, and the fixes are delivered in version 1.22.1. Technical summary The advisory describes three security fixes: a predictable key in FileTransfer.RetrieveFiles that lets a malicious sandboxed application redirect drag-and-drop and copy-paste data to itself (GHSA-c5cf-79w8-pvfh), arbitrary write access to nonexistent files outside the sandbox via the files option in FileChooser.SaveFiles (GHSA-cm83-2936-gxjm), and unvalidated App IDs in the Document Portal that could cause arbitrary host files to be parsed as Glib.KeyFile objects (#2023). The fixed release is 1.22.1. Affected version ranges, CVSS score, exploitation status, workarounds, and detection guidance are not stated in the advisory. The attack requires a malicious sandboxed application. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/flatpak/xdg-desktop-portal/releases/tag/1.22.1 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects flatpak XDG flatpak xdg-desktop-portal XDG Desktop Portal NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Medium	4.6	CVE-2026-55422	conda-forge is a GitHub organization containing repositories of conda recipes conda-forgeconda-forge.github.io	NVD	Oct 23 13:17 UTC
CVE-2026-55422conda-forge is a GitHub organization containing repositories of conda recipes Executive summary A stored cross-site scripting flaw affects the conda-forge.org status dashboard, which shows automated bot output to any visitor without login. The advisory rates it Moderate, with a CVSS 3.1 base score of 4.6 shown in the text. The advisory says no patched version exists because the site deploys continuously from the main branch, and it recommends rendering the status text as plain text instead of HTML. Technical summary The flaw is CWE-79, where two React components use dangerouslySetInnerHTML to render bot-generated status strings without sanitization. Attack vector is network, and an attacker would need to control a feedstock recipe or upstream source so that the bot captures an HTML payload into published JSON; the advisory calls weaponization plausible but not demonstrated end to end. Affected versions are stated as at or before commit 85748ad2368a on the main branch, and patched versions are stated as None. No workaround is stated beyond the recommended fixes, which are plain-text rendering, DOMPurify with a strict allowlist, HTML escaping at the producer, and a CSP without unsafe-inline for scripts. The advisory describes the CVSS vector as CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N in one place and CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N in another, and does not state detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/conda-forge/conda-forge.gith…/GHSA-r5vj-wgjv-r524 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Affects conda-forge conda-forge.github.io NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Medium	6.5	CVE-2026-55190	Event Schedule is an open-source platform to share events, sell tickets and bring communities together eventscheduleeventschedule	NVD	Oct 23 13:17 UTC
CVE-2026-55190Event Schedule is an open-source platform to share events, sell tickets and bring communities together Executive summary Event Schedule, an open-source platform for sharing events and selling tickets, has a server-side request forgery flaw in its import URL check. An authenticated user with a curator role could use it to reach internal or localhost services through event import. The advisory rates it Moderate with a CVSS 3.1 base score of 6.5, and the stated fix is to strip brackets from IPv6 hosts, fail closed on DNS resolution failures, and pin validated IPs. Patched versions are stated as None. Technical summary The flaw is a server-side request forgery (CWE-918) in App\Utils\UrlUtils::isUrlSafe(), which is meant to block unsafe import URLs. Bracketed IPv6 literals such as http://[::1]:6379/ bypass the IPv6 checks because parse_url keeps the brackets, and a hostname with only an AAAA record fails open because the IPv4-only resolver skips the private-IP check. The attack requires an authenticated user with a curator role who can supply import_urls, and the attacker can read internal responses surfaced in events. Affected versions are stated as <= 1.0.0 and patched versions as None, so no fixed version is stated. The advisory gives remediation guidance but no workaround, and it does not state whether exploitation in the wild has occurred or provide detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eventschedule/eventschedule/…/GHSA-664j-55hw-p8fm Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects eventschedule eventschedule NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Low	2.4	CVE-2026-54711	pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores Aiven-Open, pghoardAiven-Open pghoard, pghoard	NVD	Oct 23 13:17 UTC
CVE-2026-54711pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores Executive summary The pghoard PostgreSQL backup tool writes database usernames and passwords to its debug log when it uses a .pgpass file. The advisory rates the issue Low, with a CVSS v4 base score of 2.4, and the vendor recommends upgrading to version 2.7.1 or later. Technical summary This is CWE-532, insertion of sensitive information into a log file: when .pgpass is used, the connection username and password are written at debug log level. The attack requires local access with High privileges and passive user interaction, and the CVSS v4 vector is CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Affected versions are stated as less than 2.7.1 and the patched version is 2.7.1. The advisory's workaround is to filter out debug-level logs. The advisory does not state whether exploitation has been observed in the wild, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Aiven-Open/pghoard/security/…/GHSA-mpx4-jmpr-vm8v Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required High User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Aiven-Open pghoard Aiven-Open pghoard pghoard NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Low	2.3	CVE-2026-115752	Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs Signal KSignal K signalk-server	NVD	Oct 23 13:17 UTC
CVE-2026-115752Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs Executive summary Signal K Server versions from 2.28.0-beta.2 before 2.34.0 contain a server-side request forgery flaw in the App Store icon fetcher, which trusts absolute icon URLs supplied by plugin authors. The advisory does not state a severity rating or a CVSS score. The fix is described in the advisory's code changes, and the advisory does not state a separate vendor recommendation beyond the fixed version range. Technical summary The flaw is classified as server-side request forgery (CWE class not stated) in the App Store icon fetcher, which accepted absolute signalk.appIcon URLs from plugin package.json files. The attack precondition is a plugin author supplying a hostile or internal-network URL, and the advisory does not state the required privileges or user interaction. Affected versions are from 2.28.0-beta.2 before 2.34.0, and a fixed version is not separately stated beyond the 2.34.0 boundary. The changes add a CDN-only fetch check with manual redirect handling, ignore absolute appIcon URLs, and add tests; no workaround is stated. The advisory does not state whether the flaw has been exploited in the wild, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/SignalK/signalk-server/commi…5252da397948e5101dc6 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Signal K Signal K signalk-server NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Medium	6.3	CVE-2026-115751	Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using... agentfrontagentfront mcp-from-openapi	NVD	Oct 23 13:17 UTC
CVE-2026-115751Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using... Executive summary The advisory says Agentfront mcp-from-openapi versions from 2.2.0 before 2.9.0 contain a server-side request forgery flaw that lets attackers bypass the ssrf.blockedHosts denylist. The advisory text is truncated, so its stated severity, exploitation status, and full impact are not stated. The visible material is mainly a diff of documentation and tests showing fixes for hostname normalization, IPv6 transition addresses, and header handling on redirects; the advisory does not explicitly say what the vendor recommends beyond the fix in version 2.9.0. Technical summary The flaw is a server-side request forgery issue in which blockedHosts checks could be bypassed, likely through hostname variants such as trailing root dots or case differences, and through IPv6 forms that embed IPv4 addresses such as NAT64, 6to4, and IPv4-compatible addresses. The affected range is stated as from 2.2.0 before 2.9.0. The attack vector and required privileges are not stated in the visible text. The diff also shows caller headers being forwarded across redirects, which the change now restricts to the spec origin. No workaround is explicitly stated in the advisory, though the documentation notes that for untrusted input, allowedHosts should be combined with network egress controls. CVSS score, exploitation in the wild, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/agentfront/mcp-from-openapi/…23490ab244343eb5fc44 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects agentfront agentfront mcp-from-openapi NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Medium	6.3	CVE-2026-115750	mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch()... agentfront, mcp-from-openapiagentfront mcp-from-openapi, mcp-from-openapi	NVD	Oct 23 13:17 UTC
CVE-2026-115750mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch()... Executive summary The advisory says mcp-from-openapi versions from 2.5.0 before 2.9.0 can expose credentials, specifically Authorization and Cookie headers, to attackers. The advisory text shown is truncated and includes a diff of documentation and test changes, so the full severity rating is not stated. The advisory does not clearly state a vendor recommendation beyond the code and documentation changes shown. Technical summary The advisory describes a credential exposure flaw in mcp-from-openapi from 2.5.0 before 2.9.0, where Authorization and Cookie headers can be captured because safeFetch() forwards caller headers across redirects. The shown diff indicates that caller headers are now dropped once a redirect leaves the original origin, and that hostname matching for allowedHosts and blockedHosts is normalized. The diff also adds SSRF checks for IPv6 transition addresses and trailing-dot hostnames. The advisory text is truncated, so CVSS score, attack preconditions in full, workarounds, and detection guidance are not stated. The fixed version is stated as 2.9.0 only as the upper bound of the affected range. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/agentfront/mcp-from-openapi/…23490ab244343eb5fc44 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects agentfront mcp-from-openapi agentfront mcp-from-openapi mcp-from-openapi NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Medium	4.8	CVE-2026-115749	hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing... hydra-ecosystem, hydra-ray-launcherhydra-ecosystem hydra-ray-launcher, hydra-ray-launcher	NVD	Oct 23 13:17 UTC
CVE-2026-115749hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing... Executive summary The advisory says hydra-ray-launcher versions 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contain an arbitrary module import flaw, reachable through the ray_pkg_version OmegaConf resolver. The advisory does not state a severity rating, and the vendor's recommended fix is to move to the updated releases, which change the resolver to read installed package metadata instead of importing modules. Technical summary The flaw is an arbitrary module import issue in the ray_pkg_version OmegaConf resolver, which previously imported a module by name to read its __version__ attribute. The diff replaces that import with a lookup of installed distribution metadata via importlib.metadata, and the change notes say the resolver now takes distribution names rather than import names. Affected ranges are stated as 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2, with fixed versions 1.2.2 and 1.4.0rc2 implied by those ranges. The advisory does not state a CVSS score, attack preconditions, exploitation status, or a workaround beyond the migration guidance, and it gives no detection guidance. Users should replace import-style names such as yaml with distribution names such as PyYAML, and install packages (including editable installs) so their metadata is available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hydra-ecosystem/hydra/commit…16b1229bd1614b73d765 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects hydra-ecosystem hydra-ray-launcher hydra-ecosystem hydra-ray-launcher hydra-ray-launcher NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Low	2.3	CVE-2026-115730	i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash i18nexti18next-http-backend	NVD	Oct 23 13:17 UTC
CVE-2026-115730i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash Executive summary The i18next-http-backend library version 4.0.2 has an incomplete fix for a flaw that lets attackers redirect translation requests to another website by supplying a namespace value that starts with a slash. The advisory does not state a severity rating. The vendor's recommendation is to upgrade to version 4.0.3, which adds a whole-URL check. Technical summary The flaw is an incomplete fix in the interpolateUrl() function, which builds translation request URLs from templates. When a template places {{ns}} directly after a leading slash, such as /{{ns}}/{{lng}}.json, a namespace value of /evil.example produces a protocol-relative URL (//evil.example/en.json) that browsers send to another origin. The 4.0.2 check only inspected the value and missed this case. The fix in 4.0.3 checks the interpolated URL as a whole and refuses URLs starting with // or backslash variants unless the template does the same, and the advisory references GHSA-9jhj-wvmw-cfx5. The advisory does not state a CVSS score, exploitation status, or a separate workaround, and it does not provide specific detection guidance beyond the test cases. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/i18next/i18next-http-backend…a76b22cb45d48f1e35b7 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects i18next i18next-http-backend NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.9	CVE-2026-115729	@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf pdfmepdfme common	NVD	Oct 23 13:17 UTC
CVE-2026-115729@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf Executive summary The advisory says @pdfme/common versions from 5.5.10 before 6.2.6 contain a server-side request forgery flaw that lets attackers bypass the URL safety check used when fetching base PDF templates. An attacker could use this to make the server request internal or otherwise restricted addresses. The advisory's diff shows the fix is a stricter URL check, and it does not state a severity rating. Technical summary The flaw is a server-side request forgery (SSRF) in the getB64BasePdf function, where the isUrlSafeToFetch denylist can be bypassed through alternative IP address notations and IPv6 forms such as IPv4-mapped, NAT64, and 6to4 addresses. The advisory states the affected range as 5.5.10 before 6.2.6 and the fix appears in 6.2.6 per the version range, though the advisory does not explicitly name a fixed version beyond that range. The diff replaces the old checks with a parser that validates IPv4 and IPv6 literals against non-public ranges and rejects loopback hostnames, and its code comment notes that DNS names resolving to internal addresses and redirects are not covered. Attack vector details such as required privileges and user interaction are not stated, and no CVSS score is stated. No workarounds or detection guidance are stated beyond the code comment about server-side validation of untrusted templates. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/pdfme/pdfme/commit/d03d0bc49…2879793c5ff52c5600a6 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects pdfme pdfme common NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.7	CVE-2026-115728	@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213 hapijs, hapihapijs @hapi/content, hapi @hapi/content	NVD	Oct 23 13:17 UTC
CVE-2026-115728@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213 Executive summary The @hapi/content Node.js package, versions 6.0.1 before 6.0.3, contains a regular expression denial of service flaw in its Content.disposition() function. The advisory says this is an incomplete fix for an earlier issue, CVE-2026-35213. The advisory does not state a severity rating, and it does not give a vendor remediation step beyond the fixed version range. Technical summary The flaw is a regular expression denial of service (ReDoS) in Content.disposition(), caused by an incomplete fix for CVE-2026-35213. The advisory states the affected range as 6.0.1 before 6.0.3, so 6.0.3 is the fixed version as written. The advisory does not state the attack vector details, required privileges, or whether a crafted Content-Disposition header is reachable remotely in typical deployments. The advisory does not state any workaround or detection guidance. The embedded source excerpt shows the contentDispositionParamRegex and contentDispositionRegex patterns used by disposition(), but the advisory does not explicitly describe the exploit input. CVSS score and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hapijs/content/blob/v6.0.2/lib/index.js#L96 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects hapijs hapi hapijs @hapi/content hapi @hapi/content NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.1	CVE-2026-112863	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS:... Hogash, PatchstackHogash KALLYAS	NVD	Oct 23 13:17 UTC
CVE-2026-112863Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS:... Executive summary A cross-site scripting flaw affects the KALLYAS WordPress theme, versions 4.25.0 and earlier. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. No official patch is stated as available, and the vendor's recommended immediate action is to update the theme, or ask a hosting provider or developer for help if that is not possible. Technical summary This is a reflected cross-site scripting (XSS) vulnerability classified under OWASP A3: Injection, in the KALLYAS theme by developer Hogash. The advisory states that the required privilege is unauthenticated, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page, so user interaction is needed. Affected versions are stated as <= 4.25.0. No patched version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule to block attacks until an official patch is available, and the advisory recommends mitigating or resolving the issue immediately. Detailed workarounds beyond the Patchstack rule, and specific detection guidance, are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Hogash Patchstack Hogash KALLYAS NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112859	Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. ThemeREX Group, WordPressThemeREX Group Little Birdies, WordPress Little Birdies Theme	NVD	Oct 23 13:17 UTC
CVE-2026-112859Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. Executive summary A PHP Object Injection flaw in the Little Birdies WordPress theme, published by ThemeREX Group, affects all versions up to and including 1.3.16. The advisory rates it 9.8 CVSS and high priority, and says it is expected to be exploited in mass campaigns. It states that no official patch is available, and the recommended immediate action is to update the theme if a fix exists, or to ask a hosting provider or web developer for help while a mitigation rule is used. Technical summary The flaw is an insecure deserialization of untrusted data (PHP Object Injection, OWASP A3: Injection) in the Little Birdies theme. The advisory states it requires no privileges (unauthenticated access). Affected versions are listed as from n/a through 1.3.16 and <= 1.3.16. No patched version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released, which is the only workaround described. The advisory does not state specific detection indicators, and it does not say whether exploitation in the wild has been observed beyond the expectation that it will be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group WordPress ThemeREX Group Little Birdies WordPress Little Birdies Theme NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112858	Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. Axiomthemes, PatchstackAxiomthemes Rhodos	NVD	Oct 23 13:17 UTC
CVE-2026-112858Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. Executive summary A deserialization flaw in the Rhodos WordPress theme, published by axiomthemes, affects versions up to and including 1.3.3. The advisory rates it 9.8 (critical) and says it is expected to be exploited, and it notes that no official patch is available yet. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, which Patchstack classifies under OWASP A3 Injection. The advisory states that it can be exploited without authentication (required privilege: Unauthenticated), and the CVSS severity is listed as 9.8. Vulnerable versions are stated as <= 1.3.3, and the NVD entry says "from n/a through 1.3.3". No patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available. The advisory advises updating the theme once a fix exists, and asking a hosting provider or developer for help if that is not possible. No specific detection indicators, exploit details, or fixed version are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Rhodos NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112857	Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. Axiomthemes, PatchstackAxiomthemes Reprizo	NVD	Oct 23 13:17 UTC
CVE-2026-112857Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. Executive summary A deserialization flaw in the Reprizo WordPress theme, affecting versions through 1.0.8, lets unauthenticated attackers run harmful code on affected websites. Patchstack rates it high priority with a CVSS score of 9.8 and expects it to be exploited. The advisory says no official patch is available yet, and it recommends updating the theme when a fix exists or asking a hosting provider or developer for help in the meantime. Technical summary The weakness is PHP Object Injection, classified under deserialization of untrusted data (OWASP A3: Injection). The advisory states that it requires no authentication, and it gives a CVSS severity of 9.8. Affected versions are listed as from n/a through 1.0.8 and as <= 1.0.8. The advisory states that no official patched version is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released. The advisory does not state a specific workaround beyond that rule, and it does not describe the exact vulnerable code path or payload format. Detection guidance beyond the Patchstack mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Reprizo NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112856	Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. ThemeREX Group, PatchstackThemeREX Group Vagabonds	NVD	Oct 23 13:17 UTC
CVE-2026-112856Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. Executive summary A deserialization flaw in the Vagabonds WordPress theme by ThemeREX Group affects versions up to and including 1.3.10. The advisory rates it as high priority with a CVSS score of 9.8 and says it is expected to be exploited in mass campaigns. The advisory says no official patch is available, and the recommended immediate action is to mitigate or update the theme, or ask a hosting provider or web developer for help. Technical summary The flaw is PHP Object Injection, caused by deserialization of untrusted data, and is classed under OWASP A3: Injection. The advisory says it requires no authentication (unauthenticated access) and gives a CVSS 9.8 severity. The affected versions are listed as from n/a through 1.3.10, and the advisory states no official patched version is available. Patchstack has issued a mitigation rule to block attacks, but the advisory does not describe its details or any manual workaround. Specific exploit mechanics, vulnerable code paths, and detection indicators are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group Vagabonds NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112855	Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. AxiomthemesAxiomthemes Redy	NVD	Oct 23 13:17 UTC
CVE-2026-112855Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. Executive summary A deserialization flaw in the Redy WordPress theme by axiomthemes lets unauthenticated attackers run harmful code on affected websites. The advisory rates it 9.8 out of 10 severity and says it is expected to be exploited in mass attack campaigns. The advisory says to update the theme immediately, but notes that no official patch is available yet, so a mitigation rule from Patchstack is the interim option. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states it requires no authentication (required privilege: Unauthenticated), and it affects Redy versions from n/a through 1.3.5, with 1.3.5 listed as vulnerable. The advisory states that no official patched version is available, so the fixed version is not stated. The CVSS vector string is not stated, though the advisory gives a CVSS severity of 9.8. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released; beyond that, no other workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Redy NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112854	Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. AxiomthemesAxiomthemes Holistic Center	NVD	Oct 23 13:17 UTC
CVE-2026-112854Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. Executive summary A deserialization flaw in the Holistic Center WordPress theme, published by axiomthemes, lets attackers inject PHP objects into sites running version 1.2.6 and earlier. The advisory rates it critical at CVSS 9.8 and says it requires no login and is expected to be exploited. The advisory says no official patch is available yet, and it recommends updating the theme once a fix exists, or asking a hosting provider or web developer for help if that is not possible. Technical summary The vulnerability is classified as PHP Object Injection (untrusted data deserialization, OWASP A3: Injection) in the Holistic Center theme, affecting versions from n/a through 1.2.6. The advisory states the required privilege is unauthenticated, so remote exploitation appears to need no account, though the exact network vector is not described. No patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available, which is the only workaround mentioned. The advisory does not give specific detection indicators or logging guidance, and it does not state whether exploitation in the wild has been observed beyond saying it is expected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Axiomthemes Holistic Center NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112853	Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. Axiomthemes, PatchstackAxiomthemes Hallelujah	NVD	Oct 23 13:17 UTC
CVE-2026-112853Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. Executive summary A deserialization flaw in the Hallelujah WordPress theme by axiomthemes affects versions up to and including 1.1.1. The advisory rates it critical at CVSS 9.8, notes it can be exploited without logging in, and says mass-exploit campaigns are likely. The advisory states no official patch is available, and it recommends updating the theme if a fix exists or using Patchstack's mitigation rule until one does. Technical summary The flaw is PHP Object Injection, caused by deserialization of untrusted data, and the advisory says it allows object injection. The required privilege is unauthenticated, and the advisory does not describe the specific request or parameter used to reach the flaw. The affected versions are listed as from n/a through 1.1.1, and the advisory gives no fixed version because the patched version is not stated and no official patch is available. No workaround beyond the Patchstack mitigation rule is described, and no detection guidance, indicators of compromise, or exploitation-in-the-wild confirmation is given. The advisory does not state a CVSS vector string, only a score of 9.8. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Axiomthemes Patchstack Axiomthemes Hallelujah NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-112852	Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. ThemeREX GroupThemeREX Group Helion	NVD	Oct 23 13:17 UTC
CVE-2026-112852Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. Executive summary A deserialization flaw in the Helion WordPress theme from ThemeREX Group affects all versions through 1.1.12. Patchstack rates it high priority with a CVSS score of 8.1 and says it is expected to be exploited. The advisory says no official patch is available yet, and it recommends updating the theme once a fix exists, or asking a hosting provider or web developer for help if that is not possible. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, which lets attackers manipulate how the site processes data to run harmful actions on the server. Patchstack lists the required privilege as unauthenticated, so no login is needed according to the advisory. The vulnerable versions are stated as from n/a through 1.1.12 and <= 1.1.12, and no patched version is stated because no official patch is available. Patchstack says it has issued a mitigation rule that blocks attacks until an official patch is applied, but the advisory does not describe that rule's details. The advisory does not state a specific workaround beyond updating, detection guidance, or whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group ThemeREX Group Helion NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112851	Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. ThemeREX Group, PatchstackThemeREX Group HotLock	NVD	Oct 23 13:17 UTC
CVE-2026-112851Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. Executive summary A deserialization flaw in the HotLock WordPress theme by ThemeREX Group affects versions up to and including 1.3.9. The advisory rates it as high priority with a CVSS score of 9.8 and says it is expected to be exploited, so it could let an unauthenticated attacker take control of affected websites. No official patch is stated as available, so the advisory recommends mitigating the issue immediately, such as with the Patchstack mitigation rule. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states that required privilege is unauthenticated, and that an attacker can manipulate how the site processes data to run harmful actions on the server. Affected versions are stated as from n/a through 1.3.9 and <= 1.3.9. No official patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule to block attacks, and the advisory recommends updating the affected theme if possible, or asking a hosting provider or developer for help. No specific detection guidance, exploitation evidence beyond the expectation of exploitation, or other workarounds are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group HotLock NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-112850	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local... AncoraThemes, WordPressAncoraThemes Your Dress, WordPress Your Dress Theme	NVD	Oct 23 13:17 UTC
CVE-2026-112850Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local... Executive summary A local file inclusion flaw affects the Your Dress WordPress theme by AncoraThemes, in versions 1.4.1 and earlier. Patchstack rates it high priority with a CVSS severity of 8.1, and says attackers could make the site load server files it should not, sometimes leading to a takeover. The advisory says no official patch is available yet, and recommends updating the affected theme or, if that is not possible, asking a hosting provider or web developer for help. Technical summary The weakness is classed as Improper Control of Filename for Include/Require Statement, also described as PHP Remote File Inclusion, and Patchstack classifies it as Local File Inclusion under OWASP A3: Injection. The advisory states that it requires no authentication (required privilege: unauthenticated). Affected versions are stated as <= 1.4.1, and the advisory says no official patched version is available. The advisory states that Patchstack has issued a mitigation rule to block attacks until an official patch can be tested and applied. No specific workaround beyond that rule, no detailed exploitation steps, and no detection indicators are stated, and it is not stated whether exploitation in the wild has been observed beyond the claim that it is expected to be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects AncoraThemes WordPress AncoraThemes Your Dress WordPress Your Dress Theme NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.1	CVE-2026-112849	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects... AivahThemesAivahThemes Hostme v2	NVD	Oct 23 13:17 UTC
CVE-2026-112849Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects... Executive summary A cross-site scripting flaw affects the Hostme v2 WordPress theme by AivahThemes, in versions 7.0 and earlier. The advisory rates it at CVSS 7.1 and says it is expected to be exploited, and it recommends updating the theme right away or asking a hosting provider or web developer for help if that is not possible. Technical summary The flaw is a DOM-based cross-site scripting issue (CWE class: improper neutralization of input during web page generation) in the Hostme v2 theme, with versions 7.0 and earlier listed as vulnerable and a CVSS severity of 7.1. The advisory says it can be triggered by an unauthenticated attacker, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page. A patched version is not stated, and the advisory says no official patch is available at the time of writing. Patchstack has issued a mitigation rule to block attacks until an official patch is available, which is the only workaround described. The advisory does not state specific detection guidance or whether exploitation has been observed in the wild beyond a statement that it is expected to become exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects AivahThemes AivahThemes Hostme v2 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112848	Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. AivahThemes, PatchstackAivahThemes Hostme v2	NVD	Oct 23 13:17 UTC
CVE-2026-112848Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. Executive summary A deserialization flaw in the Hostme v2 WordPress theme from AivahThemes allows attackers to inject objects into the site. Patchstack rates it high priority with a CVSS score of 9.8, and it says the flaw is likely to be exploited in mass attacks. No official patch is stated as available, and the advisory recommends updating or mitigating immediately, with a web host or developer's help if needed. Technical summary The weakness is PHP Object Injection caused by deserialization of untrusted data, and the advisory classifies it under OWASP A3 Injection. The attack requires no authentication (unauthenticated access), and the CVSS score of 9.8 is given by Patchstack. The advisory says the affected versions are from n/a through 7.0 and lists <= 7.0 as vulnerable, with no official patched version stated ("No official patch available"). Patchstack has issued a mitigation rule that blocks attacks until an official patch is applied, and the advisory does not describe a manual workaround or specific detection signatures beyond that. The advisory does not state a CVSS vector string or whether exploitation has been observed in the wild, only that it is expected to be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects AivahThemes Patchstack AivahThemes Hostme v2 NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112847	Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. ThemeRexThemeRex ZenSoul	NVD	Oct 23 13:17 UTC
CVE-2026-112847Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. Executive summary A deserialization flaw in the ZenSoul WordPress theme, made by ThemeREX, lets outside attackers inject objects into the site. The advisory rates it 9.8 on CVSS and says it is expected to be exploited in mass attack campaigns. The recommended action is to update the theme, but the advisory states no official patch is available, so it suggests using a mitigation rule or asking a hosting provider or developer for help. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, and the advisory states it requires no authentication (required privilege: Unauthenticated). The vulnerable versions are listed as from n/a through 1.13 and as less than or equal to 1.13. No fixed version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch can be tested and applied. The advisory does not state a specific workaround beyond that mitigation rule, and it gives no detection guidance or indicators of compromise. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeRex ThemeRex ZenSoul NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112846	Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. ThemeREX Group, PatchstackThemeREX Group Save Life	NVD	Oct 23 13:17 UTC
CVE-2026-112846Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. Executive summary A deserialization flaw in the Save Life WordPress theme from ThemeREX Group lets attackers inject objects into the site, and the advisory rates it as highly dangerous with a CVSS score of 9.8. Versions 1.2.14 and earlier are affected. The advisory says no official patch is available, so the recommended immediate step is to update the theme if a fix exists, or to use the mitigation rule Patchstack has issued until an official patch can be tested and applied. Technical summary The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states it can be exploited without authentication (required privilege: Unauthenticated) and that it affects Save Life from n/a through 1.2.14, with vulnerable versions listed as <= 1.2.14. The advisory says no official patch is available and does not state a patched version. Patchstack has issued a mitigation rule that blocks attacks until an official patch is available. The advisory does not state exploitation in the wild as confirmed, though it says exploitation is expected and that similar flaws are used in mass-exploit campaigns. Detection guidance beyond the Patchstack mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group Patchstack ThemeREX Group Save Life NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Medium	6.8	RHSA-2026:88668	ca-certificates security update Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6, Red Hat Enterprise Linux Server - AUS 8.6, Red Hat ca-certificates	Red Hat Security Advisories	Oct 23 12:20 UTC
RHSA-2026:88668CVE-2026-114406ca-certificates security update Executive summary This Red Hat advisory covers a critical update to the ca-certificates package for Red Hat Enterprise Linux 8.6 Extended Update Support and Advanced Mission Critical Update Support systems. The update distrusts eMudhra intermediate certificate authority certificates because of security concerns. Red Hat recommends applying the updated package from its errata. Technical summary The advisory describes one fix, tracked as CVE-2026-114406, which distrusts eMudhra intermediate CA certificates in the ca-certificates trust store. The advisory rates the update Critical but does not state the CVSS base score, the attack vector, or the preconditions for exploitation. The fixed package is ca-certificates-2026.2.92_v9.0.319-80.3.el8_6 for the listed RHEL 8.6 Extended Life Cycle and AUS x86_64 products. The advisory gives no workarounds and no detection guidance, and it points to https://access.redhat.com/articles/11258 for application instructions. Whether the vulnerability is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88668 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 Red Hat Enterprise Linux Server - AUS 8.6 Red Hat ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 12:20 UTC Read the advisory
	Unknown	n/a	CVE-2026-98916	In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98916In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that... Executive summary The advisory covers a fix in the Linux kernel's wireless (nl80211) code that makes color change requests check that the wireless link is beaconing before passing the request to the driver. The advisory does not state how severe the issue is, and it does not state a CVSS score or any vendor recommendation beyond applying the stable tree fix. Technical summary The flaw is described only as a missing validation step: a color change request could reach the driver without first confirming the link is beaconing, which the patch addresses by returning -EINVAL when the link's beacon interval is zero. The advisory does not state the vulnerability class, the attack vector, or the privileges or preconditions needed to trigger it. No affected or fixed kernel version numbers are stated, only a commit hash (51423d370739aa3f701fdfbfcc52ecf321dfd71a) and an upstream commit reference. No workaround, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/51423d370739aa3…dfbfcc52ecf321dfd71a Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98915	In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98915In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as... Executive summary This advisory describes a fix in the Linux kernel's video-i2c media driver, where the driver was unregistering its video device in a way that did not properly disconnect its buffer queue during removal. The advisory does not state how serious the issue is, and it does not describe a known exploit. Technical summary The advisory is a kernel stable-tree commit that changes video_i2c_remove() to call vb2_video_unregister_device() instead of video_unregister_device(), because the driver uses vb2_fop_release() as its file release operation. The commit message says this ensures the vb2 queue is disconnected before the video device is unregistered. The advisory does not state the vulnerability class, the attack vector or preconditions, or a CVSS score. It does not give affected or fixed version numbers, does not describe workarounds, and does not provide detection guidance. The commit is dated 2026-05-12 by the committer and lists the patch author as Arash Golgol. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/56384b486b80ce4…3689aae49995f908f90d Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98914	In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return... Linux, AMDLinux, Linux kernel, amdgpu	NVD	Oct 23 12:18 UTC
CVE-2026-98914In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return... Executive summary This advisory is a Linux kernel stable-tree commit that limits how deeply the amdgpu driver's ATOM command tables can nest, which guards against kernel stack overflow. The advisory does not state a severity rating or exploitation status, and it does not describe a specific attacker-facing impact beyond kernel stack overflow. The stated remedy is the kernel patch that adds the depth cap. Technical summary The fix addresses unbounded recursion in the ATOM command table interpreter of the amdgpu DRM driver, which could cause a kernel stack overflow. The patch adds a nesting limit of 32 levels tracked by an execute_depth counter in the atom context, and returns -ELOOP when the limit is exceeded. The advisory does not state the attack vector or preconditions, affected kernel versions, CVSS score, or any workaround. Detection guidance is not stated. Fixed versions are not stated as version numbers; only the upstream commit 27ef1795bc4e47cae838e0a3ced531c549f9b23d is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/27ef1795bc4e47c…e0a3ced531c549f9b23d Score No CVSS score published. Affects Linux AMD Linux Linux kernel amdgpu NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98913	In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP... Linux, CaviumLinux, Linux kernel, Cavium ThunderX	NVD	Oct 23 12:18 UTC
CVE-2026-98913In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP... Executive summary A resource leak in the Linux kernel's ThunderX network driver (nicvf_probe) could leave a PTP device reference held after certain initialization failures. The advisory does not state a severity rating or any exploitation details, and it describes the change as a fix that adds a common error path to release the reference. Technical summary This is a reference leak (CWE-style resource management flaw) in the thunderx nicvf_probe() function: cavium_ptp_get() takes a reference to a PTP PCI device via pci_get_device(), and if a later initialization step fails, that reference was not released. The fix adds an err_put_ptp error path that calls cavium_ptp_put() and changes the pci_enable_device() failure path to jump to it. The advisory does not state a CVSS score, attack vector, preconditions for triggering the leak, affected version ranges, fixed kernel version numbers, workarounds, or detection guidance. The advisory references a patch commit (2bcf59eefb9f00a2b1d426b639ee49c305a80695) but does not list affected or fixed release versions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2bcf59eefb9f00a…26b639ee49c305a80695 Score No CVSS score published. Affects Linux Cavium Linux Linux kernel Cavium ThunderX NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98912	In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next... LinuxLinux, Linux kernel, Linux kernel stable tree	NVD	Oct 23 12:18 UTC
CVE-2026-98912In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next... Executive summary A bug in the Linux kernel's ALSA sequencer OSS read path caused reads to misbehave when the buffer size did not match the next queued event. The advisory does not state a severity rating, and the fix is a stable kernel patch that corrects the size check. Technical summary The flaw is an inverted size check in snd_seq_oss_read() in the ALSA sequencer OSS compatibility code (sound/core/seq/oss/seq_oss_rw.c). The check stopped reads when the event was smaller than the remaining buffer, so small events were not copied and larger events could be copied into a smaller read count. The fix breaks only when the remaining user buffer is smaller than the next event and returns -EINVAL when no complete event has been copied. The advisory does not state the attack vector, required privileges, or exploitation status. Affected and fixed version ranges are not stated beyond the stable commit identifiers shown. No workaround and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/20b8520d1ef9961…f7abdde47b99136c0785 Score No CVSS score published. Affects Linux Linux Linux kernel Linux kernel stable tree NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	7.5	CVE-2026-98911	In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the... Linux, NXPLinux, Linux kernel, NXP dpaa2-switch	NVD	Oct 23 12:18 UTC
CVE-2026-98911In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the... Executive summary This advisory covers a fix in the Linux kernel's dpaa2-switch network driver, where a frame error path freed memory incorrectly. The advisory describes it as a kernel fix resolving a memory handling error, but it does not state a severity rating, and no exploitation details are given. Technical summary The flaw is in the error path of dpaa2_switch_rx(), where dpaa2_switch_free_fd() was called on a receive frame descriptor even though that function is meant for Tx descriptors that carry a valid skb pointer. The fix moves the dma_unmap_page() call into dpaa2_switch_rx() and uses free_pages() on error before an skb exists and kfree_skb() afterwards. The advisory does not state the vulnerability class, attack vector, or preconditions, nor a CVSS score. Affected and fixed version ranges are not stated, and no workaround or detection guidance is given. The advisory shows a kernel stable commit, and the upstream commit ID is 74c1c9f5c0c30bbd0c2cf87b6e3507e7ea46c13d. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/259ad6093204b99…7e6d0ad90ef9a71a44ab Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Linux NXP Linux Linux kernel NXP dpaa2-switch NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98910	In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying... Linux, AMDLinux, Linux kernel, amdkfd	NVD	Oct 23 12:18 UTC
CVE-2026-98910In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying... Executive summary The advisory describes a fix in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) debug trap code. The flaw left debug trap state inconsistent when a copy to userspace failed, which could break later debug requests. The advisory does not state a severity rating, and the fix is a kernel patch that the publisher's text describes as unwinding the failed enable. Technical summary The weakness is improper cleanup of state on an error path in kfd_dbg_trap_enable() in drivers/gpu/drm/amd/amdkfd/kfd_debug.c. When copy_to_user() fails, the function returned -EFAULT after the trap was already activated, debug_trap_enabled was set, a process reference was taken, and the debug event file was opened, leaving a refcount imbalance. The fix deactivates the trap and undoes the enable setup before returning. The advisory does not state the attack vector, required privileges, or exploitation status, and it does not state affected or fixed version ranges. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/01112e241e37f9a…f418d93ce2e0b87b7ee0 Score No CVSS score published. Affects Linux AMD Linux Linux kernel amdkfd NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98909	In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before... Linux, TILinux, Linux kernel, TI cpsw_new	NVD	Oct 23 12:18 UTC
CVE-2026-98909In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before... Executive summary This advisory describes a resource cleanup bug in the Linux kernel network driver for the TI CPSW Ethernet switch (cpsw_new). When driver probe fails during port registration, a devlink instance was left registered, which the advisory describes as a fix in the stable kernel tree. The advisory does not state a severity rating, and it does not describe any exploitation or required fix action beyond applying the patched kernel. Technical summary The flaw is a resource leak in the error path of cpsw_probe() in drivers/net/ethernet/ti/cpsw_new.c. If cpsw_register_ports() fails after cpsw_register_devlink() succeeded, the devlink instance and its parameters remained registered after probe failed. The patch adds a clean_unregister_devlink label that calls cpsw_unregister_devlink() before the existing notifier cleanup. The advisory does not state an attack vector, privileges required, or any impact beyond the leak. Affected and fixed kernel version numbers are not stated in the advisory, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0a44945b0d3422f…49c97e293f3e21a8c585 Score No CVSS score published. Affects Linux TI Linux Linux kernel TI cpsw_new NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98908	In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup()... Linux, MicrochipLinux, Linux kernel, Microchip sparx5	NVD	Oct 23 12:18 UTC
CVE-2026-98908In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup()... Executive summary This advisory is a Linux kernel stable-tree patch that fixes a resource cleanup bug in the Microchip Sparx5 network driver, which handles traffic-control flower rules for PSFP (per-stream filtering). The advisory does not state a severity rating or any exploitation details. The fix is a code change in the stable kernel tree that the maintainers merged, so the vendor's recommendation is to apply the updated kernel. Technical summary The flaw is a resource leak: when sparx5_tc_flower_psfp_setup() fails after acquiring stream gate, flow meter, or stream filter resources, those earlier allocations are not released. The patch adds error paths to release them, and changes sparx5_psfp_fm_add() to return the acquired flow-meter id before the early return for reused flow meters, so the correct reference count is decremented on failure. The advisory does not state the attack vector, required privileges, or exploitability, and does not give affected or fixed kernel version numbers beyond the commit reference. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/46e50367338702a…661df7795bdada40fef7 Score No CVSS score published. Affects Linux Microchip Linux Linux kernel Microchip sparx5 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98907	In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the... LinuxLinux, Linux kernel, Linux btrfs	NVD	Oct 23 12:18 UTC
CVE-2026-98907In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the... Executive summary A race condition in the Linux kernel's btrfs file system code can occur when a block device's block size is changed while btrfs reads its superblock. The advisory describes the fix as a locking change in the kernel stable tree, and does not state a severity rating. Technical summary The flaw is a race condition in the btrfs zoned-device code, where sb_write_pointer() reads the superblock from the block device page cache without serializing against BLKBSZSET block size changes. The fix wraps the read_cache_page_gfp() call with filemap_invalidate_lock() and filemap_invalidate_unlock(). The advisory does not state the attack vector, required privileges, or exploitability, and does not state a CVSS score. Affected and fixed version ranges are not stated in the text provided. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/123b9a545f4d034…558a032bf2a93ee5722f Score No CVSS score published. Affects Linux Linux Linux kernel Linux btrfs NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98906	In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma... Linux, MicrochipLinux, Linux kernel, Microchip lan966x	NVD	Oct 23 12:18 UTC
CVE-2026-98906In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma... Executive summary A fix in the Linux kernel's network driver for Microchip LAN966x hardware restores receive state after a failed MTU change, which could otherwise leave the receive path inconsistent. The advisory does not state a severity rating or an exploitation status. The advisory describes a stable-tree patch and does not give separate vendor recommendations beyond applying the kernel update. Technical summary The flaw is an inconsistent-state issue in the lan966x FDMA receive reload path: after a failed reallocation for a new MTU, rx->page_order and rx->max_mtu were not restored, and the XDP RXQ memory model registration was not rolled back, so RX could restart with old pages but new page geometry. The advisory describes a possible frame size mismatch in the XDP path after a failed jumbo MTU reload. Attack vector, required privileges, and exploitability are not stated. Affected and fixed kernel versions are not stated as version numbers in the text. Workarounds are not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3883898ddc26308…ba8068951ab5eddbd111 Score No CVSS score published. Affects Linux Microchip Linux Linux kernel Microchip lan966x NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98905	In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off... Linux, AMDLinux, Linux kernel, amdkfd	NVD	Oct 23 12:18 UTC
CVE-2026-98905In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off... Executive summary A bug in the Linux kernel's AMD GPU compute driver (amdkfd) can leave queue buffers unset during checkpoint and restore (CRIU) of user queues. The advisory describes this as a kernel stable tree fix and does not state a severity rating or impact beyond a possible null pointer use. The fix is a code change in the stable kernel tree, and the advisory does not state any workaround. Technical summary The flaw is a missing call to kfd_queue_acquire_buffers() in the CRIU restore path, so queue_properties buffer fields may remain unfilled when later code expects them to be non-null, which the advisory describes as a possible null pointer condition. The fix adds the acquire call, adds cleanup calls on failure, and corrects pointer casts in set_queue_properties_from_criu() to void __user pointers. The advisory does not state the attack vector, required privileges, or exploitability. It does not state affected or fixed version ranges beyond the referenced commit 20a5e7ffdfecddc34c60a6b4483f42acf3d8731d and cherry-picked commit 88ed96abbbe27b70193544fbc1ee06448c274714. No workaround or detection guidance is stated, and no CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/20a5e7ffdfecddc…a6b4483f42acf3d8731d Score No CVSS score published. Affects Linux AMD Linux Linux kernel amdkfd NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98904	In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98904In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe... Executive summary This advisory describes a Linux kernel change to the i.MX mailbox driver that reorders device power management setup during probe so the device is not used before probe completes. The advisory does not describe an exploitable security flaw, a severity rating, or an attack, and it does not state a CVSS score. Technical summary The change in the imx-mailbox driver (drivers/mailbox/imx-mailbox.c) switches to devm_pm_runtime_enable(), removes manual pm_runtime_disable() calls, and moves devm_mbox_controller_register() after the runtime PM handling in imx_mu_probe. The stated motivation is to avoid early use of the device before probe completes, which the advisory describes as a mitigation of an issue reported by sashiko. The vulnerability class, attack vector, preconditions, and impact are not stated. Affected and fixed kernel versions are not stated. No workaround is stated, and no detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1f602619e408b6e…e76656a2a5ab6e89c5e4 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98903	In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98903In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem Executive summary A fix was made in the Linux kernel's mailbox driver for NXP i.MX chips, addressing a race during channel teardown where an interrupt could be re-enabled after shutdown. The advisory does not state a severity rating or any exploitation details, and it describes the change as a fix to a timing problem that can cause an interrupt to be mishandled on shared handlers. Defenders should apply the stable kernel update that contains this commit. Technical summary The flaw is a race condition in the i.MX mailbox driver (drivers/mailbox/imx-mailbox.c) in which the receive interrupt can be re-enabled by the interrupt handler while the shutdown path waits in free_irq(). The advisory says the race requires specific timing and could cause the IRQ core to disable a shared interrupt with a 'nobody cared' message. The fix adds a per-channel shutdown flag, set under a lock, so the unmask path only re-enables the event when the channel is not shutting down. The advisory does not state a CVSS score, attack vector or privileges required, affected or fixed version numbers, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: NXP i.MX mailbox driver Summarized from git.kernel.org/stable/c/02273054b2e94e5…a5644265bb9d8f7ee2a7 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98902	In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98902In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look... Executive summary This advisory covers a fix in the Linux kernel's software RAID (md/raid5) code, where a sequence counter comparison could misbehave after the counter wraps around. The advisory does not state how severe the issue is, and it does not describe any recommended action beyond the upstream patch. Technical summary The flaw is a wrap-around bug in a 32-bit sequence number comparison (bm_seq) in the md/raid5 batching logic, so a newer value can compare as smaller than an older one. The fix changes a plain greater-than comparison to a wrap-safe subtraction check in stripe_add_to_batch_list in drivers/md/raid5.c. The advisory does not state the vulnerability class, attack vector, or preconditions, the affected or fixed kernel versions, a CVSS score, workarounds, or detection guidance. The excerpt shows only the upstream commit by Chen Cheng, committed by Yu Kuai on 2026-06-21. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/00e93faf4cea9e8…5dfee0952d84fc95c40f Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98901	In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE_CACHING when... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98901In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE_CACHING when... Executive summary The advisory describes a fix in the Linux kernel's ksmbd SMB file server component, which handles lease break and acknowledgment state for SMB clients. It does not state how severe the flaw is, and it does not give a CVSS score. The change is a stable-tree kernel patch that the advisory says resolves the issue. Technical summary The advisory describes a logic error in the ksmbd server's handling of SMB2 oplock and lease breaks: valid lease states containing WRITE_CACHING were skipped during level-II/read lease breaks for writes and truncates, and lease break acknowledgments were not handled per the SMB2 rule that the acknowledged state must be a subset of the server's break target. The patch applies the acknowledged state directly and keeps the break pending on failed ACKs. The advisory does not state the vulnerability class by CWE, the attack vector, or required privileges. It does not state affected or fixed version numbers beyond the commit identifiers, does not give workarounds, and does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/17699905a381621…5b6528feb05acedc86a4 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98900	In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array... Linux, XenLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98900In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array... Executive summary A fix was committed to the Linux kernel stable tree for the Xen grant allocation driver (xen/gntalloc). The change rejects oversized allocation requests before the kernel reserves memory for them, which prevents a user-controlled allocation from exceeding the global limit. The advisory does not state a severity rating or any workaround. Technical summary The flaw is in gntalloc_ioctl_alloc(), which allocated the grant-id array with kcalloc() before checking the requested count against the global grant limit, so a user-controlled count could drive the allocation size. The fix adds an early check that returns -ENOSPC when op.count exceeds the limit, rechecks the limit using a subtraction-based comparison under gref_mutex to avoid integer wrap, and casts the count to 64-bit before multiplying by PAGE_SIZE. The advisory describes the bug as an allocation-before-validation issue but does not state a CVSS score, attack vector details beyond ioctl access, affected or fixed kernel version numbers, exploitation status, or detection guidance. These items are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2299822f3f466b5…377bf63986199f881a6b Score No CVSS score published. Affects Linux Xen Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	7.8	CVE-2026-98899	In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98899In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to... Executive summary This advisory concerns a locking fix in the Linux kernel's netfilter ipset code, which is part of the kernel's packet filtering subsystem. The advisory does not state how severe the issue is or whether it can be exploited, and it does not give any vendor recommendation beyond applying the stable kernel commit. Technical summary The change corrects how RCU read locks and spinlocks are used in the netfilter ipset hash set code (mtype_gc and mtype_add in ip_set_hash_gen.h), and the commit message says the reference counter bump does not need to hold the RCU lock because the hash table cannot disappear. The advisory does not state a vulnerability class, attack vector, or preconditions, and does not state a CVSS score. Affected and fixed kernel versions are not stated in the text provided. Workarounds are not stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0c46c9ce2413065…60c27fba5d445f5abd06 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98898	In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the... Linux, AMDLinux, Linux kernel, amdgpu	NVD	Oct 23 12:18 UTC
CVE-2026-98898In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the... Executive summary A fix in the Linux kernel's AMD Southern Islands power management code (drm/amd/pm/si) stops thermal work from being scheduled when the power management queue was never set up. The advisory does not state how serious the issue is or whether it can be exploited. The advisory describes a stable-tree patch and does not give a specific recommendation beyond applying the kernel fix. Technical summary The flaw is described as scheduling thermal work on a queue that has not been initialized, which occurs when Dynamic Power Management is disabled with the amdgpu.dpm=0 module parameter. The fix changes the condition in si_dpm_process_interrupt so that schedule_work is called only when amdgpu_dpm is also set. The advisory does not state the vulnerability class, attack vector, or preconditions beyond DPM being turned off, and it does not state a CVSS score. Affected and fixed kernel versions are not stated, though the patch is a cherry-pick into a stable tree with commit 2750f52b58d92ca52a5496c00db8abf925103a27. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/2750f52b58d92ca…96c00db8abf925103a27 Score No CVSS score published. Affects Linux AMD Linux Linux kernel amdgpu NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98897	In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a... LinuxLinux, Linux kernel, Linux ksmbd	NVD	Oct 23 12:18 UTC
CVE-2026-98897In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a... Executive summary The advisory describes a fix in the Linux kernel's ksmbd SMB server component, where lease break handling could stall for up to 35 seconds while holding a lock. The advisory does not describe an attack or a severity rating, and it does not state whether the flaw is exploitable by outside parties. The fix is a code change that releases a lock before waiting for lease break acknowledgments, and the advisory does not describe any other vendor recommendation. Technical summary The flaw is a locking issue in ksmbd (fs/smb/server/oplock.c) where __smb_break_all_levII_oplock() waited for a lease break acknowledgment while holding ci->m_lock for read, which blocked the close path that would wake the waiter, causing a 35 second timeout delay. The advisory describes the scenario as a cifs.ko client caching a read-handle lease through deferred close with a conflicting open arriving. The fix collects target opinfos with references while holding the lock and breaks them after releasing it, and it applies the same change to the parent lease break paths. Affected and fixed version numbers are not stated, and no CVSS score, attack vector rating, or workaround is stated. Exploitation status and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/27a9bc968d4ae80…ca2f2b136856ee613cb4 Score No CVSS score published. Affects Linux Linux Linux kernel Linux ksmbd NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98896	In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98896In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue... Executive summary The advisory concerns a fix in the Linux kernel's Thunderbolt driver, where a hotplug event could be processed after the driver's domain had been removed, creating a possible use-after-free. The advisory does not state a severity rating, and the fix is a kernel stable-tree patch. Technical summary The flaw is a possible use-after-free in the thunderbolt driver's hotplug workqueue: tb_handle_hotplug() may run after tb_domain_remove() has freed the domain, for example when the driver is unloaded while a device router is plugged in. The fix takes a domain reference in tb_queue_hotplug() before scheduling the handler and releases it after processing. The advisory does not state the attack vector, required privileges, or exploitability beyond this race condition. Affected and fixed version ranges are not stated, and no CVSS score, workaround, or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/04df2985159e381…23fae1bec2f8d0272412 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	7.0	CVE-2026-98895	In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created... Linux, NVIDIALinux, Linux kernel, NVIDIA mlx5	NVD	Oct 23 12:18 UTC
CVE-2026-98895In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created... Executive summary The advisory describes a fix in the Linux kernel's mlx5 driver for Mellanox network hardware, where deleting a table that has a miss table could leave a stale list entry. The advisory does not state how severe the issue is, and it does not give a vendor recommendation beyond the kernel patch itself. Technical summary The flaw is a list-management bug in the net/mlx5 HWS steering code: when a table with a miss table created by mlx5hws_table_set_default_miss is destroyed, its node remains in the miss_tbl list, leaving garbage data behind. The fix adds a check in mlx5hws_table_destroy that removes the table from the miss_tbl list when a miss table is set. The advisory does not state the vulnerability class, attack vector, or preconditions for exploitation, and it does not state any affected or fixed kernel version numbers. It does not mention workarounds, exploitation in the wild, or a CVSS score. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/60e9e82f162ab73…ff2185119289e4f6dc06 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux NVIDIA Linux Linux kernel NVIDIA mlx5 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98894	In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read... Linux, AMDLinux, Linux kernel, amdgpu	NVD	Oct 23 12:18 UTC
CVE-2026-98894In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read... Executive summary A flaw in the AMD GPU driver code within the Linux kernel could cause the CPER error-record handling path to hang when it receives corrupt data. The advisory describes this as a fix that resets the affected ring to an empty state so the writer can exit the recovery path. The advisory does not state a severity rating, and it does not describe any recommended action beyond applying the kernel fix. Technical summary The weakness is a loop that never makes progress (a hang or denial of service) in the amdgpu CPER ring overflow recovery code, triggered when corrupt CPER data yields an entry size that does not advance the read pointer after dword conversion and masking. The mutex held during this loop can block the worker writing the next CPER record. The fix detects a no-progress read pointer update and resets the ring to empty, and the referenced commit is 4d695e66d7027a0c78302e47ac76293675fbbb4d in the Linux kernel stable tree. The advisory does not state the attack vector, required privileges, or whether the corrupt data is attacker-controllable. It does not state affected or fixed kernel version numbers, a CVSS score, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/4d695e66d7027a0…2e47ac76293675fbbb4d Score No CVSS score published. Affects Linux AMD Linux Linux kernel amdgpu NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98893	In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings... Linux, ARMLinux, Linux kernel, ARM SCMI	NVD	Oct 23 12:18 UTC
CVE-2026-98893In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings... Executive summary The advisory covers a fix in the Linux kernel's ARM System Control and Management Interface (SCMI) sensor driver, where sensor update notifications were not checked for payload size before being parsed. The advisory does not state how severe the issue is, and it does not describe a specific fix recommendation beyond the patch itself. Technical summary The flaw is an input validation problem: the SCMI sensor parser read a variable-length array of sensor readings from a SENSOR_UPDATE notification without first confirming the received payload was long enough to contain them. The fix adds length checks that reject truncated update notifications before the array is read. The advisory does not state the attack vector, preconditions, CVSS score, or exploitation status. It does not list affected or fixed version ranges, and it gives no workaround. Detection guidance is not stated beyond the patch diff. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1bbe431fc59704d…0647516f6f94ddd82564 Score No CVSS score published. Affects Linux ARM Linux Linux kernel ARM SCMI NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98892	In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98892In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of... Executive summary The advisory describes a fix in the Linux kernel's Arm SCMI firmware driver, where the BASE_ERROR_EVENT notification handler did not check that the received payload contained all reported entries. The advisory does not state a severity rating, and it does not describe any exploitation or impact beyond the missing check; the fix is a patch merged into the Linux stable tree. Technical summary The weakness is a missing payload size validation in the arm_scmi base protocol notification parser, which used the command count encoded in error_status without confirming the received payload held all reported entries. The advisory does not state the attack vector, preconditions, or privileges required, and it does not give a CVSS score. The fix, in drivers/firmware/arm_scmi/base.c, rejects payloads smaller than the header or smaller than the header plus cmd_count entries before copying the report array. The advisory does not list affected or fixed kernel version numbers, does not describe workarounds, and gives no detection guidance beyond the patch itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/28d65a0a46435d4…6943c518095dff1602a1 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98891	In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the... LinuxLinux, Linux kernel, Linux mac80211	NVD	Oct 23 12:18 UTC
CVE-2026-98891In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the... Executive summary The advisory describes a flaw in the Linux kernel's wireless networking code (mac80211) that can be reached by processing a received deauthentication frame. The advisory does not state how severe the flaw is, and the text shown describes a patch that validates the frame length before reading the reason code. Technical summary The flaw is in ieee80211_rx_mgmt_deauth(), which read the deauthentication reason code before checking that the fixed field was present in the received frame, a missing bounds check that is consistent with an out-of-bounds read. The fix moves the reason code read after a length check using offsetofend on the deauth reason_code field, and the patch is shown as a commit in the Linux kernel stable tree. The attack vector and preconditions are not stated, and the advisory does not describe an impact such as a crash or information leak. Affected and fixed kernel version numbers are not stated, workarounds are not stated, and no detection guidance is given. CVSS score and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/4a360c6e18dfa9d…c7247a6a8cc8dfe0d60f Score No CVSS score published. Affects Linux Linux Linux kernel Linux mac80211 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98890	In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to... Linux, MarvellLinux, Linux kernel, Marvell libertas	NVD	Oct 23 12:18 UTC
CVE-2026-98890In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to... Executive summary A flaw in the Linux kernel's libertas wireless driver lets a short monitor-mode transmit frame be read past the end of its buffer. The advisory does not state a severity rating or a score. The fix is a kernel patch that rejects short monitor frames, and the advisory points to the stable kernel tree commit as the remedy. Technical summary The weakness is an out-of-bounds read in lbs_hard_start_xmit() in the libertas driver's tx.c, where a radiotap TX header is cast from skb->data and a destination address is read at offset 4 without a sufficient length check. The advisory says the generic check only rejects zero-length and oversized frames, so a short monitor-mode frame can be read past the end of the data. The fix requires enough bytes for the radiotap TX header and the destination address field before parsing. Affected and fixed kernel version numbers are not stated in the advisory, and no CVSS score is stated. Attack vector and required privileges are not stated. Workarounds and detection guidance are not stated beyond the referenced commit 13ff543e0b2c713aedeaadadde686686e949dc78. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/13ff543e0b2c713…adadde686686e949dc78 Score No CVSS score published. Affects Linux Marvell Linux Linux kernel Marvell libertas NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	7.8	CVE-2026-98889	In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before... Linux, IntelLinux, Linux kernel, Intel iwlwifi	NVD	Oct 23 12:18 UTC
CVE-2026-98889In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before... Executive summary The advisory describes a flaw in the Linux kernel's Intel wireless driver (iwlwifi, mvm component) where scheduled scan data could be copied into a fixed buffer before its length was checked. The advisory does not state a severity rating or exploitation status. The fix reorders the scan setup code and corrects the advertised maximum scan information element length, and the stable kernel tree commit is the remedy referenced. Technical summary The flaw is a buffer sizing and ordering issue: in the scheduled scan path, the probe request was built before the iwl_mvm_scan_fits() check, so oversized information elements could be copied into a fixed buffer before validation. The fix moves iwl_mvm_build_scan_probe() after the fits check and sets max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes. The advisory does not state the attack vector, required privileges, or whether the issue is remotely triggerable. No affected or fixed kernel version numbers, CVSS score, workaround, or detection guidance are stated in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/05f79cea3b15cfe…05ddcfd51ebee15d908a Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Intel Linux Linux kernel Intel iwlwifi NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98888	In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is... LinuxLinux, Linux kernel, Linux arm64 kprobes	NVD	Oct 23 12:18 UTC
CVE-2026-98888In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is... Executive summary A flaw in the arm64 kernel's kprobe debugging code could leave interrupts permanently disabled when one kprobe is hit while another is single-stepping. The advisory does not state a severity rating, and it does not describe an exploit. The advisory does not state a vendor recommendation or a fixed version. Technical summary The arm64 kprobe handler treated a kprobe hit during the KPROBE_HIT_SS state as unrecoverable, when it is a one-level reentry that can be handled. The fix moves KPROBE_HIT_SS into the recoverable reentry cases and extends struct prev_kprobe with a saved_irqflag field, so a nested kprobe no longer overwrites the outer kprobe's DAIF state. Without the fix, the outer single-step can leave interrupts permanently disabled. The advisory describes the triggering condition as tracing or perf code running from the debug exception path, but it does not state an attack vector, privileges required, affected or fixed kernel versions, workarounds, or detection guidance. The advisory also does not state a CVSS score or whether the issue is exploited in the wild. The fix mirrors an x86 commit, 6a5022a56ac3. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel Linux arm64 kprobes NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98887	In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the... LinuxLinux, Linux kernel, Linux mac80211_hwsim	NVD	Oct 23 12:18 UTC
CVE-2026-98887In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the... Executive summary A flaw in the Linux kernel's mac80211_hwsim wireless test driver could let a malformed message read past the end of its data. The advisory does not state how severe the flaw is or whether it is being exploited. The fix is a kernel stable tree patch that requires an exact length for the affected attribute. Technical summary The weakness is an out-of-bounds read in hwsim_tx_info_frame_received_nl(), which reads IEEE80211_TX_MAX_RATES entries of 8 bytes from the HWSIM_ATTR_TX_INFO payload without checking its length. The netlink policy only set a maximum length and the operation sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute was accepted. The fix changes the policy to NLA_POLICY_EXACT_LEN so malformed attributes are rejected before the handler runs. The advisory does not state the affected or fixed kernel versions, a CVSS score, the required privileges, a workaround, or any detection guidance. Whether the flaw is reachable by unprivileged users is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/13edd8ea7ff2ce6…290ef2034cd8cbed96c7 Score No CVSS score published. Affects Linux Linux Linux kernel Linux mac80211_hwsim NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98886	In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98886In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to... Executive summary The advisory describes a bug fix in the Linux kernel's gma500 display driver for Oaktrail HDMI I2C reads. The flaw could cause a read to wait forever, and the fix makes the driver return errors instead of reporting a false success. The advisory does not state a severity rating, and the text provided does not include a vendor recommendation beyond applying the stable-tree patch. Technical summary The weakness is in xfer_read(), which loops on an interruptible completion wait with a timeout but ignores both timeout and signal return values, so the loop can wait indefinitely if the interrupt never advances the transaction state. The patch returns -ETIMEDOUT on expiry, propagates interrupted waits, and makes the I2C master_xfer callback return the first transfer error instead of a success count. The advisory does not state the attack vector, preconditions, or whether it is exploitable by a local or remote party. Affected and fixed kernel version numbers are not stated, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/09a950950e7e4e7…e60941c8e816ef1b4f71 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98885	In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and... LinuxLinux, Linux kernel, Linux ext4	NVD	Oct 23 12:18 UTC
CVE-2026-98885In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and... Executive summary A flaw in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem causes a kernel warning when a file's extended attributes are changed during early boot on a read-only filesystem. The advisory describes the issue as a fix that returns an error early rather than attempting the change. The advisory does not state a severity rating, and it does not describe a recommended action beyond the fix itself. Technical summary The advisory describes a kernel fix in IMA where an attempt to change a file's extended attributes (xattrs) during early boot, while the filesystem is read-only, leads to a failed ext4 journal transaction and a kernel WARNING trace. The trace shows the call path from file open through IMA appraisal into ext4_xattr_set. The fix detects the state of the file early and returns the error instead of proceeding. The advisory does not state a CVSS score, an attack vector or required privileges, affected or fixed kernel versions, workarounds, or whether exploitation has occurred. Detection guidance is not stated beyond the warning text in the trace. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel Linux ext4 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98884	In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max_segs The max_segs field is of type unsigned short, and if... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98884In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided max_segs The max_segs field is of type unsigned short, and if... Executive summary A flaw in the Linux kernel's MMC (SD and eMMC storage) core code can crash the system when a host driver supplies an excessively large segment count. The advisory describes a kernel crash (page fault) rather than a stated security impact, and the advisory does not state a severity rating. The fix adds a validation check so the MMC core returns an error instead of crashing. Technical summary The weakness is an integer truncation: the unsigned short max_segs field can wrap to zero when a host driver sets a very large value, which makes mmc_alloc_sg() request a zero-size allocation and leads to undefined behavior and a kernel page fault in sg_init_table(). The advisory does not describe an attack vector or whether an unprivileged user can trigger it; it describes a host driver misconfiguration. The fix adds a check in mmc_mq_init_request() that returns an error and logs a message when sg_len is zero. Affected and fixed kernel version numbers are not stated in the advisory, nor are workarounds or exploitation status. Detection guidance beyond the logged error message and the crash signature shown is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98883	In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: recognize UPIO_AU My MIPS Alchemy systems generate the following warning during probe... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98883In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: recognize UPIO_AU My MIPS Alchemy systems generate the following warning during probe... Executive summary A Linux kernel commit fixes a warning that appeared during probing of the 8250 serial driver on MIPS Alchemy systems. The advisory describes it as a warning during driver probe rather than a security flaw, and it does not state a severity rating. The fix is a small code change in the kernel's serial driver, and no vendor action beyond applying the stable kernel update is mentioned. Technical summary The issue is a kernel warning ('Unsupported UART type 4') raised in set_io_from_upio() in drivers/tty/serial/8250/8250_port.c when the 8250 driver probes MIPS Alchemy hardware. The fix adds a case for UPIO_AU that does nothing, since parameters are already set in 8250_rt288x.c::au_platform_setup(). The advisory does not describe a vulnerability class, attack vector, or preconditions for exploitation. Affected and fixed kernel versions are not stated, and the advisory names no workaround. Exploitation status and CVSS score are not stated. Detection guidance is not stated beyond the kernel warning text shown in the commit message. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/49fa670efdfdd27…5cbd2beef065c08717ef Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98882	In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for dec_output_info If the driver's dec_output_info contains... Linux, Chips&MediaLinux, Linux kernel, Chips&Media wave5	NVD	Oct 23 12:18 UTC
CVE-2026-98882In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for dec_output_info If the driver's dec_output_info contains... Executive summary A flaw in the Linux kernel's wave5 video decoder driver for Chips&Media hardware could let invalid data cause the driver to write outside a buffer. The advisory does not state a severity score or an exploitation status. The advisory shows a kernel stable-tree patch that adds a range check and does not describe other vendor recommendations. Technical summary The advisory describes a buffer overflow in wave5_vpu_dec_get_output_info in drivers/media/platform/chips-media/wave5/wave5-vpuapi.c, where an index derived from the driver's dec_output_info could exceed the bounds of inst->frame_buf (a smatch report cites a 64 versus 127 bound). The fix adds a check that the computed index is below MAX_REG_FRAME and returns -EINVAL with a WARN_ON otherwise. The attack vector and preconditions are not stated. Affected and fixed version numbers are not stated; the commit ID 144f24ec0fc1e51673611912a6d14ded0a61db43 is given. No workaround or detection guidance is stated, and no CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/144f24ec0fc1e51…1912a6d14ded0a61db43 Score No CVSS score published. Affects Linux Chips&Media Linux Linux kernel Chips&Media wave5 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98881	In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98881In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time... Executive summary This advisory concerns the Linux kernel's network bridge code, where a leftover synchronization call could stall network namespace cleanup and cause heavy contention on a global kernel lock. The advisory describes the problem as a reliability issue shown by fuzzer reports of blocked tasks, and it does not state a severity score or any exploitation details. The text provided does not state what fixed kernel version or vendor recommendation applies beyond the code change itself. Technical summary The flaw is a stale rcu_barrier() call in br_multicast_dev_del() in net/bridge/br_multicast.c, which was left over from when call_rcu() was used and is no longer needed now that kfree_rcu() is used. The call trace shows a kworker thread blocked in rcu_barrier() while holding RTNL during network namespace cleanup, which causes other tasks to block on the mutex. The advisory describes the issue as causing extreme RTNL pressure in syzbot reports, and the fix is removal of the rcu_barrier() call. The advisory does not state the attack vector, required privileges, affected or fixed kernel versions, workarounds, CVSS score, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98880	In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set_blocksize failures ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE... LinuxLinux, Linux kernel, Linux ntfs3	NVD	Oct 23 12:18 UTC
CVE-2026-98880In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set_blocksize failures ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE... Executive summary This advisory covers a fix in the Linux kernel's ntfs3 driver, which handles NTFS file systems. The change makes mounting fail cleanly when the block size cannot be set, instead of hitting a kernel bug check. The advisory does not state a severity rating, and it does not give a specific vendor recommendation beyond the kernel patch itself. Technical summary The flaw is in the ntfs3 file system driver, which uses buffer heads that do not handle block sizes larger than PAGE_SIZE. Without the fix, mounting such a volume reaches a BUG_ON in folio_set_bh on the first __bread_gfp call. The patch checks the return value of sb_set_blocksize in the boot sector reading path and in the alternative boot path, and returns -EINVAL on failure. The advisory does not state affected or fixed version numbers beyond the referenced kernel commit, does not give a CVSS score, does not describe attack vector or required privileges, does not state a workaround, and gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/24f7d1824b7581a…9d443c5dfeabd89df6d8 Score No CVSS score published. Affects Linux Linux Linux kernel Linux ntfs3 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98879	In the Linux kernel, the following vulnerability has been resolved: isofs: handle set_blocksize failures isofs uses buffer_heads, which don't handle block size > PAGE_SIZE... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98879In the Linux kernel, the following vulnerability has been resolved: isofs: handle set_blocksize failures isofs uses buffer_heads, which don't handle block size > PAGE_SIZE... Executive summary The advisory describes a fix in the Linux kernel's isofs filesystem driver, which is used to mount ISO 9660 disc images. Without the fix, mounting a crafted or unusual image can trigger a kernel crash. The advisory does not state a severity rating, and the fix is a kernel patch that the Linux stable tree has already merged. Technical summary The flaw is in isofs, which uses buffer_heads that do not handle block sizes larger than PAGE_SIZE. The isofs mount code ignored the return value of sb_set_blocksize, so a failed block size change was not handled, and the first __bread_gfp call would hit a BUG_ON in folio_set_bh. The patch checks the return value and jumps to out_freesbi when the call fails. The advisory does not state the attack vector, required privileges, or whether mounting an untrusted image is needed. Affected and fixed kernel version numbers are not stated. No CVSS score, workaround, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/25ef4c4d9f0e96f…ae0d7127c3f12a31bc32 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98878	In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or... Linux, ARMLinux, Linux kernel, ARM GICv5	NVD	Oct 23 12:18 UTC
CVE-2026-98878In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or... Executive summary This advisory concerns a fix in the Linux kernel's driver for the Arm GICv5 interrupt controller. The flaw could let a long-running interrupt handler or a guest virtual machine block other incoming interrupts, which could cause a denial of service. The advisory does not state a severity score, and the fix is a change to move the priority drop earlier in interrupt handling. Technical summary The weakness is an interrupt handling flaw in the GICv5 driver (irq-gic-v5.c) where the priority drop (CDEOI) was performed only during deactivation in irq_eoi(), so interrupts of equal or lower priority could not be signalled while a handler ran. The advisory describes a denial of service effect, for example when a physical interrupt is injected into a guest VM in software, and the attack vector and preconditions beyond this are not stated. The fix moves the CDEOI priority drop to occur immediately after acknowledging an interrupt in gicv5_handle_irq() and removes the earlier CDEOI calls. Affected and fixed kernel version numbers are not stated in the advisory text, and no workaround is stated. No detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/abf60331ebe9a9a…72aac7699c2907ab9307 Score No CVSS score published. Affects Linux ARM Linux Linux kernel ARM GICv5 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98877	In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98877In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting... Executive summary A Linux kernel fix in the GIC version 4 interrupt controller code stops the kernel from advertising virtual interrupt support when no interrupt translation service (ITS) is present. Without the fix, enabling a specific KVM option on such a system could cause a kernel crash. The advisory does not state a severity rating, and it does not describe any recommended action beyond applying the upstream patch. Technical summary The flaw is a NULL pointer dereference in the irqchip GIC v4 code that causes a kernel panic. It occurs when the kvm-arm.vgic_v4_enable=1 option is set on a system that has no MSI controller device tree node and GICv4, because the gic_domain pointer is NULL. The fix sets vLPI support to false during initialization when no ITS is found, so the setting propagates to kvm_vgic_global_state.has_gicv4. The advisory does not state affected or fixed kernel version numbers, a CVSS score, attack vector or privilege requirements, workarounds, or exploitation status. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/3e4cae9f1472ba3…7edee24074618b51f537 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98876	In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x_device_init(), the error teardown... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98876In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1x_device_init(), the error teardown... Executive summary A fix in the Linux kernel's host1x bus driver addresses a possible crash caused by a missing null check during error cleanup. The advisory does not state how severe the issue is or what impact it has beyond a possible NULL pointer dereference. The advisory describes a code change in the stable kernel tree and does not give a separate vendor recommendation beyond applying the fix. Technical summary The flaw is a missing NULL pointer check: in host1x_device_init(), the teardown and teardown_late error paths dereference client->ops without first checking it, while the forward init paths guard with 'client->ops &&'. The advisory states this can cause a NULL pointer dereference. The fix adds the client->ops check in both labels in drivers/gpu/host1x/bus.c. The advisory does not state the attack vector, required privileges, or whether the issue is exploitable. No affected or fixed version numbers, CVSS score, workaround, or detection guidance are stated. The fixing commit is 29375e071ea201fe97bafe1d2ad9d9f30311abfb in the stable tree. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/29375e071ea201f…fe1d2ad9d9f30311abfb Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98875	In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2... Linux, NVIDIALinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98875In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2... Executive summary The advisory describes a resolved fix in the Linux kernel's Nouveau graphics driver, where a missing SEC2 entry in the GA100 chip table could cause a NULL pointer crash during GSP-RM boot. The advisory does not state a severity rating or a exploitation status, and it describes the change as a crash fix rather than a security exploit. Defenders should apply the upstream kernel stable update that contains this commit. Technical summary The flaw is a NULL pointer dereference in the Nouveau DRM driver: the GA100 chip table lacked a .sec2 entry, so device->sec2 was NULL when the booter constructor in tu102_gsp_oneinit() accessed the SEC2 falcon, crashing GSP-RM boot. The advisory does not state an attack vector, required privileges, or whether an attacker can trigger it. Affected and fixed kernel version ranges are not stated beyond the commit itself (604d0efb17cc0dd197e089134736ac2698d5fca7, committed 2026-05-28 in the stable tree). No workaround, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/604d0efb17cc0dd…89134736ac2698d5fca7 Score No CVSS score published. Affects Linux NVIDIA Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98874	In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must... Linux, IntelLinux, Linux kernel, Intel iwlwifi	NVD	Oct 23 12:18 UTC
CVE-2026-98874In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must... Executive summary A fix in the Linux kernel stable tree removes a kernel warning that fired when a Wi-Fi device using the iwlwifi driver was suspended with wake-on-WLAN configured while not connected to a network. The advisory describes this as a correctness fix for a valid user configuration rather than a stated security exploit. The advisory does not state a severity score, and the recommended action shown is to apply the upstream kernel commit. Technical summary The flaw is an unconditional WARN_ON() in the iwlwifi mld driver's WoWLAN suspend path (iwl_mld_wowlan_suspend in d3.c) that triggered when the device was not associated and no netdetect configuration existed. The fix removes the WARN_ON and returns 1 so the driver disconnects and suspends normally. The advisory does not state an attack vector, exploitation status, CVSS score, or a vulnerability class beyond the warning, and it does not describe a security impact. Affected and fixed kernel versions are not stated in the advisory text. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/301b0dfa9db3f1e…95e803bbd88fbd878c7c Score No CVSS score published. Affects Linux Intel Linux Linux kernel Intel iwlwifi NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98873	In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: zero at allocation time There are occasional LLM hints wrt LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98873In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: zero at allocation time There are occasional LLM hints wrt Executive summary The advisory describes a change to the Linux kernel's netfilter connection tracking code that zeroes memory when expectation objects are allocated, to prevent possible leaks of uninitialized data to userspace through ctnetlink. The advisory does not state a severity rating, and it does not describe a confirmed exploit or any recommended action beyond applying the kernel fix. Technical summary The fix addresses possible disclosure of uninitialized kernel memory to userspace via ctnetlink, in the nf_conntrack_expect allocation path. The change switches nf_ct_expect_alloc to kmem_cache_zalloc, removes explicit field initialization in ctnetlink_alloc_expect, and adds exp->dir = 0 in nf_ct_expect_init. The advisory does not state the attack vector, the privileges or preconditions required, or a CVSS score. Affected and fixed kernel versions are not stated in the text provided, and no workaround or detection guidance is given. The commit is shown with a date of 2026-06-24 and a committer date of 2026-06-30, and these are copied from the commit metadata. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/241ccd2fed9051d…adce248fc0ab30f55e97 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98872	In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG() on unknown typed-extent type vxfs_bmap_typed() handles four typed-extent types and... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98872In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG() on unknown typed-extent type vxfs_bmap_typed() handles four typed-extent types and... Executive summary The advisory describes a flaw in the Linux kernel's freevxfs filesystem driver, where a malformed on-disk file can crash the kernel. The advisory does not state a severity score, and the fix is a code change in the stable kernel tree that replaces a crash with a clean error. Technical summary The flaw is a denial of service caused by a BUG() call in the default case of vxfs_bmap_typed() in fs/freevxfs/vxfs_bmap.c, which is triggered when an on-disk typed extent has a type value outside the four handled types. The advisory says it is reachable from ioctl(FIBMAP) on a regular file, so the attacker precondition appears to be supplying or mounting a crafted filesystem image, but the advisory does not explicitly state this. The fix replaces BUG() with WARN_ON_ONCE(1) and returns 0, so the ioctl fails with -EIO. Affected and fixed kernel versions are not stated in the advisory, and no CVSS score, workaround, or detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/1284d687d46953f…d969df108114611aca8b Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Unknown	n/a	CVE-2026-98871	In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path __sev_platform_init_handle_init_ex_path()... LinuxLinux, Linux kernel	NVD	Oct 23 12:18 UTC
CVE-2026-98871In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path __sev_platform_init_handle_init_ex_path()... Executive summary The advisory describes a fix in the Linux kernel's AMD Secure Encrypted Virtualization (SEV) initialization code, where an error path could cause a deadlock. The advisory does not state a severity rating, and it describes the change as a fix for a possible deadlock that occurs after a memory page update failure. Technical summary The flaw is a possible deadlock in the crypto CCP driver's SEV init failure path, in the function __sev_platform_init_handle_init_ex_path(). The function called rmp_mark_pages_firmware() with locked=false even though the parent function already held sev_cmd_mutex, so an RMPUPDATE failure on any page after the first would trigger cleanup that reclaims pages and deadlocks in sev_do_cmd. The fix passes locked=true in drivers/crypto/ccp/sev-dev.c. The advisory does not state attack vector, privileges required, or exploitation status, and it does not state affected or fixed version numbers beyond the referenced upstream commits. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/364f3841bc22c72…b72a1e3c91c9c8fc1ef4 Score No CVSS score published. Affects Linux Linux Linux kernel NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.8	CVE-2026-98870	In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbd_sessions_deregister() removes a... LinuxLinux, Linux kernel, Linux ksmbd	NVD	Oct 23 12:18 UTC
CVE-2026-98870In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbd_sessions_deregister() removes a... Executive summary The advisory describes a flaw in the Linux kernel's ksmbd SMB server component that can leave stale channel and session data behind when a connection disconnects. The advisory does not state a severity score, and the text shown does not describe an available attack vector beyond the code path, so the risk level is not stated. The fix is a kernel patch that removes the gating condition so channels are always cleaned up on teardown. Technical summary The flaw is a use-after-free write in ksmbd, the in-kernel SMB server, where a stale channel still points to a freed ksmbd_conn structure after the connection tears down. ksmbd_sessions_deregister() only removed a connection's channels from other sessions while conn->binding was set, but that flag can be cleared by a later non-binding SESSION_SETUP on the same connection. The fix removes the conn->binding check so channels are always removed from every session on teardown, and the advisory says the stale channel is also walked through /proc, and that the session can leak. The advisory does not state affected or fixed version numbers beyond the referenced upstream commit, does not state a CVSS score, does not describe attacker preconditions in terms of authentication or network reach, and does not give workarounds or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/9cd6d714d3ca0cf…42dc989696884e41970f Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Linux Linux Linux kernel Linux ksmbd NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Low	2.1	CVE-2026-95620	A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the... qtqt, qt QNetworkAccessManager	NVD	Oct 23 12:18 UTC
CVE-2026-95620A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the... Executive summary The advisory describes a use-after-free flaw in Qt's QNetworkAccessManager HTTP/2 support that lets a malicious or compromised HTTP/2 server crash a client application, affecting availability. The advisory text is truncated, so its severity rating is not stated in the text provided, and the page is a multi-product list that also covers Axivion Dashboard and Qt for MCUs issues. Fixes are available in Qt 6.11.3 and Qt 6.12.0 for the CVE-2026-95620 item. Technical summary The flaw is a use-after-free in the QNetworkAccessManager HTTP/2 client support of the Qt Network module, and the advisory text is cut off before its full description. Exploitation requires a malicious or compromised HTTP/2 server, and the stated impact is a crash of the client application, affecting availability. Affected versions are stated as From Qt 6.9.0 to Qt 6.11.2, and fixed versions are stated as Qt 6.11.3 and Qt 6.12.0. No workaround is stated, no CVSS score is stated, and no detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.qt.io/List_of_known_vulnerabilitie…ducts#CVE-2026-95620: Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Active CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Green Affects qt qt qt QNetworkAccessManager NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Medium	4.8	CVE-2026-94263	The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the... Advanced Custom FieldsAdvanced Custom Fields Extended, Advanced Custom Fields Extended PRO	NVD	Oct 23 12:18 UTC
CVE-2026-94263The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the... Executive summary The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins, versions 0.9.2.4 through 0.9.2.7, are affected by a flaw that does not consistently disable shortcode processing. The advisory rates it medium severity with a CVSS score of 4.8, and the fix is to update to version 0.9.2.8. Technical summary The weakness is classified as injection (OWASP A1), caused by the plugins not consistently disabling shortcode processing. The advisory does not state the attack vector, required privileges, or user interaction needed to exploit it. Affected versions are 0.9.2.4 to 0.9.2.7 and the fixed version is 0.9.2.8 for both acf-extended and acf-extended-pro. The advisory does not state any workaround, and it gives no detection guidance or information on exploitation in the wild. The advisory text also lists unrelated vulnerability titles from other plugins, which are not part of this advisory's affected products. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/52f1633a-21ae-…73-8f24-5c10c2a92a8b Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affects Advanced Custom Fields Advanced Custom Fields Extended Advanced Custom Fields Extended PRO NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.8	CVE-2026-56840	PraisonAI is a multi-agent teams system MervinPraison, PraisonAIMervinPraison PraisonAI, praisonai	NVD	Oct 23 12:18 UTC
CVE-2026-56840PraisonAI is a multi-agent teams system Executive summary A cross-site scripting flaw in PraisonAI's HTTP approval dashboard lets attacker-controlled tool arguments run script when a human opens the approval page, and that script can approve the dangerous tool call without the human clicking Approve. The advisory rates it High, with a suggested CVSS v3.1 score of 8.8. The fix is to escape untrusted values before they are placed in the approval page; the advisory's affected range is 4.5.2 through 4.6.57, and the patched version is 4.6.59 or later. Technical summary This is a cross-site scripting (CWE-79) issue in praisonai.bots.HTTPApproval, where _build_html() inserts tool names, risk levels, agent names, and argument keys and values into the approval page without HTML escaping. The attack needs an attacker to influence an agent's prompt or task enough to produce a risky tool call, and the victim must open the approval URL (CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8). The injected script posts to the same-origin /approve/{request_id}/decide endpoint, which sets approved=True. Affected versions are stated as >= 4.5.2, <= 4.6.57, and the patched version is stated as >= 4.6.59. Workarounds are not stated. The advisory gives a proof of concept and a suggested fix of HTML escaping plus a restrictive Content Security Policy, but no specific detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-63v4-w882-g4x2 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects MervinPraison PraisonAI MervinPraison PraisonAI praisonai NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	7.8	CVE-2026-56838	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 12:18 UTC
CVE-2026-56838PraisonAI is a multi-agent teams system Executive summary PraisonAI, a multi-agent teams system, has a flaw where the streaming recipe path (recipe.run_stream) skips the check that blocks dangerous tools by default, so recipes declaring dangerous tools can run without the operator's explicit override. The advisory rates it High (CVSS 3.1 base score 7.8) and affects versions from 4.5.87 through 4.6.57. The advisory's suggested fix is to apply the same policy check to the streaming path, and it lists version 4.6.59 as the patched release. Technical summary This is a missing authorization check (CWE-863, with CWE-693 and CWE-78 also suggested), where recipe.run_stream() calls _execute_recipe() without running _check_tool_policy(), so dangerous tools such as execute_command are not denied unless allow_dangerous_tools=True is passed. The attacker needs the ability to invoke recipe streaming, either through the CLI with --stream or the POST /v1/recipes/stream endpoint, and the advisory's CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Affected versions are stated as >= 4.5.87, <= 4.6.57, and patched versions as >= 4.6.59. The advisory does not state any workaround. Detection guidance is not stated, and the advisory does not say whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-v847-hxxw-3pxg Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.6	CVE-2026-56837	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 12:18 UTC
CVE-2026-56837PraisonAI is a multi-agent teams system Executive summary PraisonAI's LinearBot component, in versions 4.6.56 through 4.6.58 according to the advisory, accepts forged Linear webhook events when the LINEAR_WEBHOOK_SECRET setting is missing, letting any network caller who can reach the webhook endpoint invoke the configured AI agent. The advisory rates this High with a suggested CVSS 3.1 score of 8.6. The fix is listed as version 4.6.59 and later, and the advisory recommends failing closed by refusing to start or reject requests when no secret is configured. Technical summary The flaw is an authentication bypass (CWE-306, CWE-287, CWE-347) in which the webhook handler skips Linear-Signature HMAC verification when no signing secret is set, and the listener binds to 0.0.0.0. An unauthenticated remote attacker who can reach the webhook port can send a forged Linear-Event: AgentSession request, which is passed to the agent through BotSessionManager.chat() and can produce a Linear comment under the bot token. Affected versions are stated as >= 4.6.56, <= 4.6.58, with the patched version given as >= 4.6.59. The advisory also says the component appears in tags back to v4.5.50 and suggests at least 4.5.50 may be affected, but says maintainers should confirm the exact range. Workarounds beyond setting LINEAR_WEBHOOK_SECRET or restricting network access are not stated. Exploitation in the wild is not stated. Detection guidance beyond the proof-of-concept test cases is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-fc26-m9pf-v56q Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.2	CVE-2026-56836	PraisonAI is a multi-agent teams system MervinPraison, PraisonAIMervinPraison PraisonAI, praisonai	NVD	Oct 23 12:18 UTC
CVE-2026-56836PraisonAI is a multi-agent teams system Executive summary A flaw in the PraisonAI praisonai Python package lets the recipe HTTP server run on a network interface without any login when started through the deprecated Typer command. The advisory rates it High with a suggested CVSS 3.1 score of 8.2, and recommends fixing the command path, adding the same guard as the legacy handler, and requiring authentication for remote binding. Affected versions are stated as >= 4.5.112, <= 4.6.58, with patched versions >= 4.6.59. Technical summary This is a missing authentication issue (CWE-306, CWE-287, CWE-862) in the deprecated praisonai recipe serve Typer command. Running it with a non-localhost host such as 0.0.0.0 starts the recipe server with CORS set to * and no auth middleware, so unauthenticated network callers can reach recipe endpoints and, if --admin is set, /admin/reload. The advisory states the attack vector is network with no privileges or user interaction required, and the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. Affected range is stated as >= 4.5.112, <= 4.6.58 with patched versions >= 4.6.59, and the advisory notes the lower bound is conservative. Suggested fixes include removing or delegating the Typer command, adding a non-localhost/no-auth guard, and adding regression tests. Workarounds beyond these fixes are not stated, and detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-5qw8-f2g9-ff29 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N Affects MervinPraison PraisonAI MervinPraison PraisonAI praisonai NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.3	CVE-2026-56835	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 12:18 UTC
CVE-2026-56835PraisonAI is a multi-agent teams system Executive summary PraisonAI's Slack bot has an authorization flaw in its app_mention handler, which skips the sender and channel allowlist checks used by the normal message handler. A Slack workspace user who can mention the bot may be able to trigger the configured AI agent despite those restrictions. The advisory rates it High (CVSS 3.1 score 8.3 as shown on the page) and the fix is to upgrade to version 4.6.59 or later. Technical summary The flaw is an incorrect and missing authorization check (CWE-863 and CWE-862) in the Slack app_mention event handler in src/praisonai/praisonai/bots/slack.py. The handler does not call is_channel_allowed, is_user_allowed, or UnknownUserHandler.handle, so allowed_users, allowed_channels, and unknown_user_policy= Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-qvpf-j64c-jmhr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	7.5	CVE-2026-56834	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 12:18 UTC
CVE-2026-56834PraisonAI is a multi-agent teams system Executive summary PraisonAI, a multi-agent teams system, has a high-severity flaw in its Dynamic Context Discovery artifact tools that can let a caller read arbitrary files readable by the PraisonAI process on the host, such as .env files, credentials, and SSH keys. The advisory says the affected versions are 3.8.1 through 4.6.58 and that the patched version is 4.6.59 or later. The advisory's recommended fix is to stop artifact tools from opening arbitrary paths and to use artifact IDs or enforce a containment check under the artifact base directory. Technical summary The flaw is a path traversal (CWE-22) with sensitive information exposure (CWE-200) in the artifact_head, artifact_tail, artifact_grep, and artifact_chunk tools, which wrap a caller-supplied path directly into an artifact reference and read it from the host filesystem without a base-directory containment check. The attack vector is network, with no privileges or user interaction stated, provided the agent exposed via ctx.get_tools() is reachable by an untrusted prompt or tool caller. The advisory says affected versions are >= 3.8.1, <= 4.6.58 and the patched version is >= 4.6.59. The advisory provides a local proof of concept and recommends resolving paths and rejecting those outside the base directory, plus validating metadata sidecars. Workarounds beyond the suggested code fix are not stated, and whether the advisory provides detection guidance for exploitation attempts is not stated. The advisory describes impact as confidentiality-only, with integrity and availability not claimed. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-j7qx-p75m-wp7g Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	7.5	CVE-2026-56833	PraisonAI is a multi-agent teams system MervinPraisonMervinPraison PraisonAI	NVD	Oct 23 12:18 UTC
CVE-2026-56833PraisonAI is a multi-agent teams system Executive summary PraisonAI, a multi-agent AI teams system, has a path traversal flaw in its Dynamic Context history and terminal tools that lets a lower-trust caller read history and terminal log files outside the configured storage directory. The advisory rates it High, with a suggested CVSS v3.1 score of 7.5, and states that the affected pip package praisonai is affected from version 3.8.1 through 4.6.58. The fix is to upgrade to version 4.6.59 or later, which the advisory lists as the patched version. Technical summary The flaw is CWE-22 path traversal, with a related CWE-200 information exposure. The history_* and terminal_* agent tools pass caller-supplied run_id and agent_id values directly into filesystem path construction without rejecting absolute paths or traversal sequences, and the tool-imposed .jsonl or .log suffix still applies. The attack requires only the ability to call these tools with chosen identifiers; the advisory suggests no user interaction and no privileges, though it notes authenticated deployments may score PR:L. Affected versions are stated as >= 3.8.1 and <= 4.6.58, and patched versions as >= 4.6.59. The advisory states no workaround is given, and it does not state any exploitation in the wild. Its suggested fixes are containment checks using resolve() and relative_to() plus an identifier allowlist, but these are recommendations rather than the vendor's stated workaround. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-22cj-m4wf-fv2c Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affects MervinPraison MervinPraison PraisonAI NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.8	CVE-2026-56832	PraisonAI is a multi-agent teams system MervinPraison, PraisonAIMervinPraison PraisonAI, praisonai	NVD	Oct 23 12:18 UTC
CVE-2026-56832PraisonAI is a multi-agent teams system Executive summary PraisonAI's Discord approval backend can be tricked into approving dangerous tool calls. Any user who can post in the configured approval channel can approve a pending high-risk action by sending a message such as yes after the approval prompt appears. The advisory rates this High, with a suggested CVSS v3.1 score of 8.8 shown in the advisory, and recommends tying approvals to the specific request and checking approver identity. Technical summary The flaw is an incorrect authorization issue (CWE-863) with insufficient verification of data authenticity (CWE-345) in DiscordApproval, in src/praisonai/praisonai/bots/_discord_approval.py. The poll loop accepts any later non-bot message in the configured channel as an approval decision, without requiring a Discord reply, a request-specific thread, an interaction or button callback, an approver allowlist, or a per-request nonce. Attack requires only write access to the approval channel and no user interaction after the prompt. Affected versions are stated as >= 4.5.2, <= 4.6.58 and patched versions as >= 4.6.59. The advisory states no workaround. Detection guidance beyond the fix recommendations is not stated, and whether the flaw has been exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/MervinPraison/PraisonAI/secu…/GHSA-8579-rgg5-ph2m Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects MervinPraison PraisonAI MervinPraison PraisonAI praisonai NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Critical	9.2	CVE-2026-115727	AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces Fosowl, AgenticSeekFosowl AgenticSeek, AgenticSeek	NVD	Oct 23 12:18 UTC
CVE-2026-115727AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces Executive summary The advisory says AgenticSeek versions before commit 409840c contain a remote code execution flaw in the LLM server component, llm_server/app.py. The server runs with Flask debug mode hardcoded on and listens on all network interfaces, which the advisory describes as allowing remote code execution. The advisory does not state a severity score, a fixed release, or a vendor recommendation beyond the commit reference. Technical summary The weakness is a hardcoded debug setting: app.run(host='0.0.0.0', threaded=True, debug=True, port=args.port) in llm_server/app.py binds the Flask server to all interfaces with debug mode enabled. The advisory identifies the result as remote code execution but does not describe the exact attack steps or required preconditions beyond network reachability of the port. Affected versions are stated as those before commit 409840c, and the advisory does not name a fixed release version. No CVSS score, workaround, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Fosowl/agenticSeek/blob/d238…erver/app.py#L52-L53 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Fosowl AgenticSeek Fosowl AgenticSeek AgenticSeek NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.5	CVE-2026-115726	Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded... Aider-AI, AiderAider-AI aider, Aider	NVD	Oct 23 12:18 UTC
CVE-2026-115726Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded... Executive summary Aider through version 0.86.2 contains a command execution flaw that lets an attacker run shell commands on a system by committing a malicious .aider.conf.yml file that Aider loads automatically. The advisory does not state a severity rating or a fixed version. Vendor recommendations, a patch, and a workaround are not stated in the provided text. Technical summary The advisory describes a command execution vulnerability in Aider through 0.86.2 in which a malicious .aider.conf.yml file, once committed to a repository, is auto-loaded and can run shell commands. The attack vector implies a victim who uses Aider in a repository containing the attacker's committed file, but the advisory does not state the exact preconditions. The page content provided is mostly a source listing of editor.py, which does not clearly show the vulnerable code path. Fixed versions, workarounds, CVSS score, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Aider-AI/aider/blob/v0.86.2/…r/editor.py#L89-L134 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Aider-AI Aider Aider-AI aider Aider NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Low	2.3	CVE-2026-115725	Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id chatwootchatwoot	NVD	Oct 23 12:18 UTC
CVE-2026-115725Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id Executive summary Chatwoot versions before 4.17.0 contain an authorization bypass that lets an authenticated agent bot reach other accounts' data. The advisory does not state a severity score. The text provided does not state a vendor recommendation beyond the fixed version 4.17.0. Technical summary The flaw is an authorization bypass (CWE class not stated). An authenticated agent bot can supply a foreign contact inbox source_id to access conversations in other accounts. The code excerpt shows the contact_inbox lookup falls back to ContactInbox.find_by!(source_id:) without scoping to the current account, and authorizes only the found inbox with show?. Affected versions are stated as before 4.17.0 and the fixed version is 4.17.0. A workaround is not stated. Exploitation in the wild is not stated. A CVSS score is not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/chatwoot/chatwoot/blob/v4.16…troller.rb#L206-L213 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects chatwoot chatwoot NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Low	2.1	CVE-2026-115724	VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the... videolanvideolan VLC for Android	NVD	Oct 23 12:18 UTC
CVE-2026-115724VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the... Executive summary VLC for Android versions before 3.7.2 contain a file overwrite flaw in the FileUtils.getUri() function that trusts content URIs too easily. The advisory text provided is truncated and does not state a severity rating or a vendor recommendation beyond the fixed version boundary. Technical summary The flaw is described as a confused-deputy file overwrite vulnerability in FileUtils.getUri(), which trusts content URIs based only on the (truncated) text. The affected versions are stated as before 3.7.2, and the source code excerpt is labeled 3.7.1. Attack vector, required user interaction, and privileges are not stated in the provided text. Workarounds are not stated. Detection guidance is not stated. A CVSS score is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/videolan/vlc-android/blob/3.…leUtils.kt#L397-L428 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects videolan videolan VLC for Android NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.3	CVE-2026-115723	Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an... davenardella, Snap7davenardella snap7, Snap7	NVD	Oct 23 12:18 UTC
CVE-2026-115723Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an... Executive summary The advisory says Snap7 through 1.4.3 contains an out-of-bounds write flaw in its passive partner component, which a malicious active partner can trigger by declaring an oversized length to overflow application buffers. The advisory text provided is truncated and does not state a severity rating, fixed version, or vendor recommendation. Technical summary The flaw is classified as an out-of-bounds write (buffer overflow) in the passive partner of Snap7 through 1.4.3, triggered when a malicious active partner declares an oversized size or length in S7 BSend data. The attack requires a peer that can establish a connection to the passive partner over the network, as the code accepts incoming connections matched to configured partner addresses; no authentication requirement is stated in the excerpt. The excerpt contains only source code from s7_partner.cpp and no fixed version, workaround, CVSS score, or detection guidance; these are not stated. The advisory text is truncated, so the exploitation details beyond the summary sentence are not fully available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/davenardella/snap7/blob/30f3…tner.cpp#L1126-L1166 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects davenardella Snap7 davenardella snap7 Snap7 NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Medium	6.9	CVE-2026-115722	RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type diegonehab, RPlydiegonehab rply, RPly	NVD	Oct 23 12:18 UTC
CVE-2026-115722RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type Executive summary The advisory describes an improper array index validation flaw in the RPly library, versions through 1.1.4, in the function ply_read_header_property(). The flaw lets the header parser accept the word list as a list property's length or value type. The advisory does not state a severity score or a fixed version, and it does not state the vendor's recommended remediation. Technical summary The weakness is classified in the advisory as improper array index validation in ply_read_header_property(), which accepts list as a list property's length or value type. The advisory does not state the attack vector, required privileges, or whether user interaction is needed, though the affected code parses PLY files from the header. The advisory states affected versions as RPly through 1.1.4. No fixed version is stated. No workaround is stated, and no detection guidance is stated. The advisory text is mostly a copied source file listing and does not describe exploitation or a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/diegonehab/rply/blob/75639e3…8/rply.c#L1228-L1251 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects diegonehab RPly diegonehab rply RPly NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	High	8.7	CVE-2026-112904	Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores givanz, Vvvebgivanz Vvveb, Vvveb	NVD	Oct 23 12:18 UTC
CVE-2026-112904Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores Executive summary The advisory describes a code change in the Vvveb content management system's backup tool, which appears to address a weakness in how backup file names and table names are handled. The advisory text does not state a severity rating for the issue. The advisory does not state a vendor recommendation or a fixed version. Technical summary The diff changes admin/controller/tools/backup.php in Vvveb. It moves backup file access to a dedicated backup directory, sanitizes the file parameter with sanitizeFileName, casts page and position parameters to integers, and rejects table names not found in the database list with a 403 'Invalid table!' response. These changes suggest the prior code allowed path traversal or arbitrary table access through request parameters, but the advisory does not state the vulnerability class, attack vector, or required privileges. Affected versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/givanz/Vvveb/commit/aa29cb01…80741bac6b69b9d403a2 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Affects givanz Vvveb givanz Vvveb Vvveb NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Medium	4.3	CVE-2026-111965	The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the... Profile BuilderProfile Builder profile-builder	NVD	Oct 23 12:18 UTC
CVE-2026-111965The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the... Executive summary The Profile Builder WordPress plugin, versions 4.0.0 through 4.0.4, has a flaw that lets logged-in users skip its reCAPTCHA check on some comment submission paths. The advisory does not state a severity rating, and the fix is in version 4.0.5. Technical summary The weakness is a failure to enforce reCAPTCHA verification on all comment submission paths in the Profile Builder plugin, which allows authenticated users to bypass the check. Affected versions are stated as 4.0.0 to 4.0.4, and the fixed version is 4.0.5. The advisory text is truncated, so the full description of attack preconditions is not available. No workaround, CVSS score, exploitation status, or detection guidance is stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/81175472-a748-…a6-9c9e-7b08adb652fc Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects Profile Builder Profile Builder profile-builder NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Critical	9.1	CVE-2026-107685	Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions,... agentjido, OpenAIagentjido req_llm	NVD	Oct 23 12:18 UTC
CVE-2026-107685Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions,... Executive summary A flaw in the req_llm Elixir library's WebSocket streaming client lets an attacker on the network path read and change OpenAI WebSocket sessions, including API keys and OAuth tokens. The advisory rates it CRITICAL with a score of 9.1. The fix is to upgrade req_llm to version 1.29.0 or later, and the advisory says the affected range is versions 1.9.0 before 1.29.0. Technical summary The weakness is improper certificate validation (CWE-295): the WebSocket client starts WebSockex without TLS options, so WebWebSockex defaults to insecure mode and skips certificate verification. An on-path attacker presenting any certificate can capture the authorization bearer token and session frames, and alter frames in both directions. The OpenAI Responses, Realtime, and Codex WebSocket paths are affected, while HTTP streaming through Finch and the HTTP/2 session through Mint are stated to verify certificates. The affected range is 1.9.0 before 1.29.0, with a git range from a389d71 before c7264fc, and the advisory states 1.29.0 returns a TLS unknown_ca error in its proof of concept. Workarounds are to keep the openai_stream_transport option at its default :sse and to avoid calling start_responses_session/2 directly; the advisory says ReqLLM.OpenAI.Realtime.connect/2 has no alternative and should not be used on affected versions. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-107685.html Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects agentjido OpenAI agentjido req_llm NIST National Vulnerability DatabasePublished Oct 23, 2026 12:18 UTC Read the advisory
	Medium	6.8	RHSA-2026:88669	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Mozilla ca-certificates, Red Hat Enterprise Linux Server - AUS 8.4	Red Hat Security Advisories	Oct 23 12:16 UTC
RHSA-2026:88669CVE-2026-114406ca-certificates security update Executive summary Red Hat has released a critical security update for the ca-certificates package on Red Hat Enterprise Linux Server AUS 8.4 x86_64. The update distrusts eMudhra intermediate Certificate Authority certificates because of security concerns, and Red Hat recommends applying the update. Technical summary The advisory describes a single fix, CVE-2026-114406, which distrusts eMudhra intermediate CA certificates in the ca-certificates package because of security concerns. The advisory does not state the vulnerability class, attack vector, or preconditions, and it does not give a CVSS score beyond the Critical rating, which is linked to a classification page. The fixed package is ca-certificates-2026.2.92_v9.0.319-80.3.el8_4 as written in the advisory, with SHA-256 checksums provided for the SRPM and the noarch RPM. No workarounds or detection guidance are stated, and exploitation in the wild is not stated. Administrators should refer to the Red Hat article at https://access.redhat.com/articles/11258 for application instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88669 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Mozilla ca-certificates Red Hat Enterprise Linux Server - AUS 8.4 Red Hat Product SecurityPublished Oct 23, 2026 12:16 UTC Read the advisory
	Medium	6.8	RHSA-2026:88662	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Mozilla ca-certificates, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8, Red Hat Enterprise Linux Server - TUS 8.8, Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8, Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8	Red Hat Security Advisories	Oct 23 11:50 UTC
RHSA-2026:88662CVE-2026-114406ca-certificates security update Executive summary Red Hat has released a Critical security update for the ca-certificates package on Red Hat Enterprise Linux 8.8 systems, including Update Services for SAP Solutions and Telecommunications Update Service variants. The update distrusts eMudhra intermediate Certificate Authority certificates because of security concerns. Red Hat recommends applying the updated package to affected systems. Technical summary The advisory describes a single fix, CVE-2026-114406, which distrusts eMudhra intermediate CA certificates in the ca-certificates package because of security concerns; the advisory does not give a detailed vulnerability class, attack vector, or preconditions beyond referring to the CVE page, and it does not state a CVSS score in the text provided. The fixed package version is ca-certificates-2026.2.92_v9.0.319-80.3.el8_8, and the advisory does not state any affected (vulnerable) version range. No workarounds are stated. No detection guidance or evidence of exploitation in the wild is stated. Administrators are directed to the Red Hat update article at https://access.redhat.com/articles/11258 for application steps. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88662 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Mozilla ca-certificates Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8 Red Hat Enterprise Linux Server - TUS 8.8 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 Red Hat Product SecurityPublished Oct 23, 2026 11:50 UTC Read the advisory
	High	8.1	RHSA-2026:88659	php security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 11:44 UTC
RHSA-2026:88659CVE-2026-109618CVE-2026-109619php security update Executive summary Red Hat has released a security update for the PHP scripting language on Red Hat Enterprise Linux 9.2 systems covered by its Update Services for SAP Solutions, Extended Life Cycle, and related subscriptions. The advisory rates the update Important and says it fixes two flaws, one of which can lead to remote code execution, so administrators should apply the packaged PHP update to affected systems. Technical summary The two flaws are CVE-2026-109618, described as an out-of-memory bailout during request parsing that leads to memory corruption and remote code execution, and CVE-2026-109619, described as fatal error handling that retains stale request state and leads to a use-after-free. The advisory does not state the attack vector, required preconditions, or CVSS scores, and refers readers to the CVE pages for those details. The fixed package version is php-8.0.30-1.el9_2.2, and the advisory lists SHA-256 checksums for each package. No workarounds and no detection guidance are stated in the advisory, and it does not say whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88659 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 11:44 UTC Read the advisory
	Medium	5.1	CVE-2026-105963	Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose... elixir-plugelixir-plug plug, elixir-plug plug_crypto	NVD	Oct 23 10:16 UTC
CVE-2026-105963Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose... Executive summary A flaw in the Elixir libraries plug and plug_crypto can cause the application's secret key base, or another compared secret, to be written into application logs and error tracker reports when a request supplies a wrong-typed value. The advisory rates it MEDIUM with a CVSS 4.0 score of 5.1. The fix is to upgrade plug to 1.7.0 or later and plug_crypto to 2.2.1 or later, and the advisory also gives code-level workarounds. Technical summary The weakness is CWE-532, insertion of sensitive information into a log file, caused by failed function-head guards in Plug.Crypto that make the Erlang VM raise FunctionClauseError with argument values in the top stack frame. An unauthenticated remote attacker can trigger it with one request, such as a bracket-syntax query parameter passed to Phoenix.Token.verify/4 or a missing request header compared with secure_compare/2, but reading the leaked value requires access to the logs or an error tracker. Affected versions are plug from 1.6.3 before 1.7.0 and plug_crypto from 1.0.0 before 2.2.1, with git ranges also listed. Fixed versions are plug 1.7.0 and plug_crypto 2.2.1, and the advisory's fix commits are aeaa90e in plug and 9818874 in plug_crypto. Workarounds include checking argument types before calling Plug.Crypto, treating missing headers as failed comparisons, and configuring the error tracker to drop stack-frame arguments, though the local log still holds the value. The advisory does not state whether the issue has been exploited in the wild, and it does not state any detection guidance beyond the affected configurations described. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-105963.html Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects elixir-plug elixir-plug plug elixir-plug plug_crypto NIST National Vulnerability DatabasePublished Oct 23, 2026 10:16 UTC Read the advisory
	High	8.1	RHSA-2026:88561	php security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 10:00 UTC
RHSA-2026:88561CVE-2026-109618CVE-2026-109619php security update Executive summary Red Hat has released a security update for PHP on Red Hat Enterprise Linux 10.0 Extended Update Support and related 4 years of updates channels. Red Hat rates the update as Important and says it fixes two flaws, one of which it describes as leading to memory corruption and remote code execution. Technical summary The advisory lists two fixes: CVE-2026-109618, an out-of-memory bailout during request parsing that leads to memory corruption and remote code execution, and CVE-2026-109619, where fatal error handling retains stale request state and leads to a use-after-free. The advisory does not state the attack vector, required preconditions, or CVSS scores, and refers readers to the CVE pages for those details. Affected PHP package version is 8.3.19-1.el10_0.2 as shown in the package lists, and the advisory does not state a separate vulnerable version range. No workarounds are stated. The advisory points to an access.redhat.com article for applying the update and does not describe specific detection guidance or evidence of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88561 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 10:00 UTC Read the advisory
	Medium	6.8	RHSA-2026:88564	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Mozilla ca-certificates	Red Hat Security Advisories	Oct 23 10:00 UTC
RHSA-2026:88564CVE-2026-114406ca-certificates security update Executive summary Red Hat has released a critical security update for the ca-certificates package on Red Hat Enterprise Linux 9.4 systems, including several Update Services, Extended Life Cycle, and AUS variants. The update distrusts eMudhra intermediate Certificate Authority certificates because of security concerns. Red Hat recommends applying the updated package, which the advisory describes as rated Critical by Red Hat Product Security. Technical summary The flaw is tracked as CVE-2026-114406 and concerns the trust store, which distrusts eMudhra intermediate CA certificates due to security concerns; the advisory does not describe the specific vulnerability class or an attack vector. The advisory does not state the preconditions for exploitation, exploitation status in the wild, or a CVSS score, and refers readers to the CVE page for those details. The fixed package is ca-certificates-2026.2.92_v9.0.319-90.3.el9_4 (noarch), and the advisory lists it for the affected 9.4 channels, including AUS, Update Services for SAP Solutions, 4 years of updates, and Extended Life Cycle on x86_64, aarch64, ppc64le, and s390x. No workarounds are stated, and no specific detection guidance is provided; the advisory points to https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88564 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Mozilla ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 10:00 UTC Read the advisory
	Medium	6.8	RHSA-2026:88560	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Mozilla ca-certificates	Red Hat Security Advisories	Oct 23 09:59 UTC
RHSA-2026:88560CVE-2026-114406ca-certificates security update Executive summary This Red Hat advisory covers a ca-certificates update for Red Hat Enterprise Linux 10.0 Extended Update Support and related 4-years-of-updates streams. Red Hat rates it Critical and says the update distrusts eMudhra intermediate CA certificates because of security concerns. Red Hat recommends applying the ca-certificates update as described in its linked guidance. Technical summary The flaw is tracked as CVE-2026-114406 and is described as a decision to distrust eMudhra intermediate CA certificates due to security concerns, so the vulnerability class and attack details are not stated. The advisory does not describe the attack vector or preconditions, and no CVSS score is given in the text (it refers to the CVE page for scores). The fixed package is ca-certificates-2026.2.92_v9.0.319-100.3.el10_0 for the listed RHEL 10.0 architectures, and no affected prior versions are stated. No workarounds or detection guidance are stated; the advisory points to https://access.redhat.com/articles/11258 for how to apply the update. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88560 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Mozilla ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 09:59 UTC Read the advisory
	High	8.1	RHSA-2026:88565	php:7.4 security update Red Hat, PHPRed Hat Enterprise Linux, PHP, Red Hat Enterprise Linux Server - AUS 8.4, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4	Red Hat Security Advisories	Oct 23 09:48 UTC
RHSA-2026:88565CVE-2026-109618CVE-2026-109619php:7.4 security update Executive summary Red Hat published an Important-rated security update for the PHP 7.4 module on Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Mission Critical Update Support systems. The advisory describes two PHP flaws, one of which it says can lead to memory corruption and remote code execution. Red Hat recommends applying the update, and the advisory points to its standard update instructions. Technical summary The advisory covers CVE-2026-109618, described as an out-of-memory bailout during request parsing that leads to memory corruption and remote code execution, and CVE-2026-109619, described as fatal error handling that retains stale request state and leads to a use-after-free. The advisory does not state the attack vector, required preconditions, or CVSS scores beyond referring to the CVE pages. Fixed package versions are listed as php-7.4.6-5.module+el8.4.0+25156+e0c98721.3 and related packages, and the advisory does not give separate fixed versions for each flaw. No workarounds or mitigations are stated. No detection guidance or evidence of exploitation in the wild is stated. Administrators should consult the Red Hat article referenced in the Solution section for installation details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88565 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Enterprise Linux Server - AUS 8.4 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 Red Hat Product SecurityPublished Oct 23, 2026 09:48 UTC Read the advisory
	High	8.8	CVE-2026-89320	`HmacShaCryptor.Hash` never hashed its input Eclipse Foundation, ThalesGroupEclipse Foundation Eclipse KeyPont - GOSE, Eclipse Foundation gose, ThalesGroup gose	NVD	Oct 23 09:17 UTC
CVE-2026-89320`HmacShaCryptor.Hash` never hashed its input Executive summary A flaw in the gose Go library's HMAC routine means that AES-CBC-HMAC encrypted JWE messages lose their integrity protection, so an attacker who has seen one valid message can alter ciphertext and still pass verification. The advisory rates the issue High (CVSS 3.1 vector given as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, with a score of 8.2 shown). The fix requires consumers to move to a new module path, eclipse-keypont/gose at v1.0.0-rc1 or later, because the original module path has no patched release. Technical summary The weakness is CWE-354, improper validation of an integrity check value, in HmacShaCryptor.Hash, which calls hash.Sum(input) without first writing the input, so it always returns HMAC_K("") regardless of input. An attacker on the network who has observed one legitimate AES-CBC-HMAC JWE can reuse its tag on forged ciphertext, headers, and IVs, and the advisory describes CBC malleability and a panic on non-block-aligned ciphertext as consequences. Affected versions are github.com/ThalesGroup/gose >= v0.9.0 and <= v0.13.0-rc1, with no patched release under that path. The fixed version is github.com/eclipse-keypont/gose >= v1.0.0-rc1, reached by changing the module path, and the fix commit is 97f9348. Workarounds are not stated for the affected releases beyond avoiding the AES-CBC-HMAC path and using AEAD/GCM instead. Data protected by affected releases should be treated as unauthenticated and re-encrypted under a patched version. Detection guidance is not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-h6w5-722x-2h3m Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse Foundation Eclipse KeyPont - GOSE Eclipse Foundation gose ThalesGroup gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.3	CVE-2026-89319	`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation Eclipse Foundation, ThalesGroup, Eclipse KeyPontEclipse Foundation Eclipse KeyPont - GOSE, ThalesGroup gose, Eclipse KeyPont gose	NVD	Oct 23 09:17 UTC
CVE-2026-89319`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation Executive summary The advisory says a flaw in the Go JOSE library gose, in its AES-CBC-HMAC direct decryption path, lets a remote sender crash the decrypting process or force a very large memory allocation. It is rated Low in the NVD-style header and Low in the CVSS summary, with availability impact only. The recommended fix is to move to the eclipse-keypont module path and use version v1.0.0-rc4, because the ThalesGroup path has no patched release. Technical summary The flaw is an improper validation of an array index (CWE-129) in JweDirectDecryptorBlock.Decrypt, which reads a 64-bit plaintext length from the attacker-controlled _thales_aad protected-header field without checking that the field exists, is at least 8 bytes, or is within the decrypted block length. The advisory says a related HMAC defect (GHSA-h6w5-722x-2h3m) lets an attacker reuse a constant tag, so the integrity gate can be passed without the MAC key, though it also notes the CVSS attack complexity is rated High. Affected versions are stated as >= 0.9.0, <= 0.13.0-rc1 for github.com/ThalesGroup/gose, which has no patched release. For github.com/eclipse-keypont/gose the advisory states the fix is in v1.0.0-rc1 and recommends v1.0.0-rc4. Workarounds are stated as none within affected releases, with avoiding the CBC-HMAC path (NewJweDirectDecryptorBlock) in favour of the GCM path suggested as a mitigation for users who cannot migrate. No CVSS vector beyond the base metrics shown, no exploitation-in-the-wild status, and no detection guidance are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-4gj8-hg2r-gw6q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse KeyPont Eclipse Foundation Eclipse KeyPont - GOSE ThalesGroup gose Eclipse KeyPont gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.9	CVE-2026-89318	`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length Eclipse Foundation, ThalesGroup, Eclipse KeyPontEclipse Foundation Eclipse KeyPont - GOSE, ThalesGroup gose, Eclipse KeyPont gose	NVD	Oct 23 09:17 UTC
CVE-2026-89318`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length Executive summary A flaw in the Go JOSE library gose lets anyone holding a recipient's public key send a crafted encrypted message that crashes the process or request handling the decryption. The advisory rates it Moderate, with availability impact only and no confidentiality or integrity loss. The recommended fix is to upgrade to github.com/eclipse-keypont/gose v1.0.0-rc4 or later, and users of the older ThalesGroup module path must change the module path, since no patched version exists under that path. Technical summary The issue is CWE-248, an uncaught exception: JweRsaKeyEncryptionDecryptorImpl.Decrypt passes the JWE initialization vector to cipher.AEAD.Open without checking its length, and Go's standard library GCM panics on any nonce that is not 12 bytes. The attack is network-reachable and requires no secret, only the recipient's RSA public key, kid, and OAEP hash, which the advisory describes as public in normal JOSE deployments. Affected versions are stated as github.com/ThalesGroup/gose >= 0.8.0, <= 0.13.0-rc1 (no patched version under that path) and github.com/eclipse-keypont/gose < 1.0.0-rc4, with the fix in >= 1.0.0-rc4. The stated workaround is to validate that the decoded IV is 12 bytes before calling Decrypt, though the advisory notes this does not fix the underlying defect. The advisory states that no detection guidance is given and that the CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; the attached analysis is AI-generated and unverified by a maintainer. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-265w-83cm-777q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse KeyPont Eclipse Foundation Eclipse KeyPont - GOSE ThalesGroup gose Eclipse KeyPont gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.3	CVE-2026-89317	gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it Eclipse Foundation, ThalesGroup, Eclipse KeyPontEclipse Foundation Eclipse KeyPont - GOSE, ThalesGroup gose, Eclipse KeyPont gose	NVD	Oct 23 09:17 UTC
CVE-2026-89317gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it Executive summary The advisory says the gose JWT/JWS verification library ignores the signed crit header, so tokens that carry issuer-mandated critical extensions it does not support are accepted instead of rejected. It rates the issue Low, noting it is not remotely exploitable by an unauthenticated party and requires a validly signed token replayed into a gose-backed verifier. The fix is to upgrade to eclipse-keypont/gose v1.0.0-rc4 or later, and users still on the ThalesGroup module path must change the module path. Technical summary This is an improper verification of a signed header parameter (CWE-347) in JwtVerifierImpl.Verify, which never reads the JWS crit header required by RFC 7515 section 4.1.11. The attack requires a token validly signed by a trusted issuer, replayed in a context where gose is the verifier; the signature covers crit, so it cannot be forged into an unsigned token. Affected versions are stated as github.com/ThalesGroup/gose >= 0.7.3, <= 0.13.0-rc1 (no patched version given on that path) and github.com/eclipse-keypont/gose < 1.0.0-rc4, fixed in >= 1.0.0-rc4. The fix rejects any non-empty crit in jose.Jwt.Verify, and the advisory gives a workaround of rejecting tokens whose crit member is present and non-empty before calling Verify. The advisory does not state exploitation in the wild, and it notes a related unfixed gap in JweProtectedHeader lacking a Crit field. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-445r-fpvv-hgwc Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse KeyPont Eclipse Foundation Eclipse KeyPont - GOSE ThalesGroup gose Eclipse KeyPont gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.3	CVE-2026-89316	`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)` Eclipse Foundation, ThalesGroupEclipse Foundation Eclipse KeyPont - GOSE, Eclipse Foundation gose, ThalesGroup gose	NVD	Oct 23 09:17 UTC
CVE-2026-89316`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(ECDSAOptions)` Executive summary The advisory says that the gose Go library for JOSE and JWK handling can crash when LoadPublicKey receives an EC key whose declared algorithm is not an EC algorithm. The advisory rates this Low severity, a denial-of-service issue that depends on the calling application forwarding untrusted key documents to the function. The vendor recommends upgrading to github.com/eclipse-keypont/gose v1.0.0-rc4 or later, and it notes that consumers on the old ThalesGroup module path must change the module path, not just the version. Technical summary The flaw is an unchecked type assertion of algToOptsMap[alg] to ECDSAOptions in LoadPublicKey, classified as CWE-248 (Uncaught Exception), which panics when a JWK with kty EC carries a non-EC alg such as RS256, PS256, or RSA-OAEP. The attack vector is network with high attack complexity, and the precondition is that the calling application passes an externally supplied JWK document directly to LoadPublicKey. Affected versions are github.com/ThalesGroup/gose >= 0.7.3, <= 0.13.0-rc1 (patched versions: None stated) and github.com/eclipse-keypont/gose < 1.0.0-rc4, fixed in >= 1.0.0-rc4. The advisory gives a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L and says the availability impact is low. No workaround beyond not passing untrusted JWKs to LoadPublicKey or validating that kty and alg agree is stated as a mitigation, and no detection guidance is given. Whether exploitation has occurred in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-fv39-8484-f4wr Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse Foundation Eclipse KeyPont - GOSE Eclipse Foundation gose ThalesGroup gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.9	CVE-2026-89315	`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim Eclipse Foundation, ThalesGroup, Eclipse KeyPontEclipse Foundation Eclipse KeyPont - GOSE, ThalesGroup gose, Eclipse KeyPont gose	NVD	Oct 23 09:17 UTC
CVE-2026-89315`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim Executive summary The advisory says that the gose Go library for JSON Web Tokens can crash when it marshals verified claims that contain common custom claim names, such as URL-namespaced names used by many identity providers. The advisory rates the issue Moderate and states a CVSS v3.1 score of 5.3, with availability impact only. The fix is to move to the Eclipse Keypont module github.com/eclipse-keypont/gose version v1.0.0-rc4 or later, because the ThalesGroup path is still vulnerable and go get -u will not fix it. Technical summary The flaw is an uncaught panic (CWE-248) in JwtClaims.MarshalJSON, which builds a struct with reflect.StructOf using field names derived from untyped claim keys. Claim names containing characters such as hyphen, dot, colon, slash, space, #, @, or URL forms, and the name utomaticJwtClaims (which collides with an embedded field), cause the panic. An attacker needs a token that passes signature verification against a trusted key, and the caller must then JSON-marshal the returned claims; the advisory notes this is a caller behaviour. The affected range is listed as >= 0.7.3 and <= 0.13.0-rc1 for github.com/ThalesGroup/gose and less than 1.0.0-rc4 for github.com/eclipse-keypont/gose, with the patched version given as >= 1.0.0-rc4. The fix commit is listed as be2277b, merged as 692c25c. Workarounds are stated as avoiding json.Marshal on the returned claims or copying UntypedClaims into a separate map first. The advisory does not state whether exploitation has been seen in the wild, and it does not state a detection method beyond the reproducer. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-hwm6-rwv6-xgq8 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse KeyPont Eclipse Foundation Eclipse KeyPont - GOSE ThalesGroup gose Eclipse KeyPont gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.9	CVE-2026-89314	`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the square of the entry count Eclipse Foundation, ThalesGroup, Eclipse KeyPontEclipse Foundation Eclipse KeyPont - GOSE, ThalesGroup gose, Eclipse KeyPont gose	NVD	Oct 23 09:17 UTC
CVE-2026-89314`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the square of the entry count Executive summary A denial-of-service flaw affects the gose Go library for JSON Web Keys, where a crafted key set under 1 MB can keep one CPU core busy for about 15 seconds. The advisory rates it Moderate and states the attacker must control the key set endpoint, such as a compromised or malicious identity provider. The recommended fix is to upgrade to eclipse-keypont/gose v1.0.0-rc4 or later, and to change the module path if still using the ThalesGroup path because that path has no fix. Technical summary The flaw is an algorithmic complexity issue (CWE-407) in jwkFields.CheckConsistency, which checks key_ops entries for duplicates with a nested loop, giving quadratic time. An attacker who controls the JWKS body (for example, a malicious or compromised endpoint or a MITM on a configured JWKS URL) can send many unique key_ops values; the advisory reports a sub-1 MB body costing roughly 15 seconds of CPU. The advisory states the affected versions as >= 0.7.3, <= 0.13.0-rc1 for github.com/ThalesGroup/gose (no patched version stated for that path) and < 1.0.0-rc4 for github.com/eclipse-keypont/gose, with the patched version stated as >= 1.0.0-rc4. The fix adds a 64-entry cap and a set-based duplicate check, and the release wraps the JWKS HTTP body in a 1 MiB limit. Workarounds are to fetch JWKS only from trusted pinned endpoints and to limit response body size, with the advisory noting a size limit alone is partial. The advisory does not state exploitation in the wild, and the CVSS v3.1 vector given is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-r56w-f43c-828p Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse KeyPont Eclipse Foundation Eclipse KeyPont - GOSE ThalesGroup gose Eclipse KeyPont gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.3	CVE-2026-89313	`JwksTrustStore.Get` assigned each parsed key to the function's named return value while refreshing the JWKS cache Eclipse Foundation, ThalesGroup, Eclipse KeyPontEclipse Foundation Eclipse KeyPont - GOSE, ThalesGroup gose, Eclipse KeyPont gose	NVD	Oct 23 09:17 UTC
CVE-2026-89313`JwksTrustStore.Get` assigned each parsed key to the function's named return value while refreshing the JWKS cache Executive summary A flaw in the Go library gose (published under Eclipse KeyPont and ThalesGroup paths) causes its JWKS trust store to return a wrong signing key, instead of no key, when a token names a key ID that is absent from the key set. The advisory rates it Low, states it is not an authentication bypass, and says the fix is to upgrade to github.com/eclipse-keypont/gose v1.0.0-rc4 or later, with consumers on the ThalesGroup module path needing to change the module path because that path has no patched version. Technical summary This is a logic error in JwksTrustStore.Get: a named return value is overwritten inside a key-loading loop and a naked return then hands back the last parsed key with err set to nil when the requested kid is not found. The trigger requires an issuer on the operator's allowlist, a non-empty JWKS, and a token whose kid header is absent from that set, and the advisory says an unauthenticated remote party can supply these. The advisory states that signature verification in JwtVerifierImpl.Verify still gates acceptance, so a token signed by an unrelated key is still rejected. Affected versions are stated as >= 0.7.5 and <= 0.13.0-rc1 for github.com/ThalesGroup/gose, and < 1.0.0-rc4 for github.com/eclipse-keypont/gose, with the fix in 1.0.0-rc4 (commit 692c25c); the advisory states no patched version exists for the ThalesGroup path. Workaround stated: callers should check that the returned key's Kid() matches the requested kid and treat a mismatch as not found. The advisory does not state any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-v7r8-g6h9-99vv Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse KeyPont Eclipse Foundation Eclipse KeyPont - GOSE ThalesGroup gose Eclipse KeyPont gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.9	CVE-2026-89312	`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length Eclipse Foundation, ThalesGroup, Eclipse KeyPontEclipse Foundation Eclipse KeyPont - GOSE, ThalesGroup gose, Eclipse KeyPont gose	NVD	Oct 23 09:17 UTC
CVE-2026-89312`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length Executive summary A flaw in the Go library gose lets a remote party crash a decrypting process by submitting a crafted JWE with a wrong-sized initialization vector. The advisory rates it Moderate, with availability impact only, and says the process crash depends on whether the calling application recovers panics. The vendor recommends upgrading the eclipse-keypont/gose module to v1.0.0-rc4 or later, and consumers on the ThalesGroup module path must change the module path as well. Technical summary The defect is an uncaught panic (CWE-248) in AesGcmCryptor.Open, which passes the attacker-supplied nonce to cipher.AEAD.Open without the length check that the Seal method performs, so a nonce not equal to 12 bytes causes the Go standard library to panic. The attack is network reachable with no privileges or user interaction, and requires only a kid present in the decryptor's keystore, which the advisory says is typically public. The advisory states that confidentiality and integrity are unaffected. Affected versions are >= 0.7.3, <= 0.13.0-rc1 for github.com/ThalesGroup/gose and < 1.0.0-rc4 for github.com/eclipse-keypont/gose; the fixed version is v1.0.0-rc4 for the eclipse-keypont path, and the ThalesGroup path has no patched version. The advisory's workaround is to validate that the decoded IV is 12 bytes for AES-GCM algorithms before calling gose, and it notes that recovering panics at the request boundary limits impact without fixing the defect. Detection guidance beyond the reproducer is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/eclipse-keypont/gose/securit…/GHSA-xx6h-2jgg-93m2 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Eclipse Foundation ThalesGroup Eclipse KeyPont Eclipse Foundation Eclipse KeyPont - GOSE ThalesGroup gose Eclipse KeyPont gose NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Critical	9.3	CVE-2026-25784	Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation Hallo Welt! GmbHHallo Welt! GmbH BlueSpice, Hallo Welt! GmbH bluespice/wiki, Hallo Welt! GmbH Extension:BlueSpiceUserManager, Hallo Welt! GmbH bluespice/formula, Hallo Welt! GmbH bluespice/search	NVD	Oct 23 09:17 UTC
CVE-2026-25784Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation Executive summary The advisory covers several flaws in Hallo Welt! BlueSpice, a wiki platform distributed as container images. The most serious flaw (CVE-2026-25784, rated Critical with CVSS 4.0 score 9.3) lets a user who can read the wiki gain administrator rights through an insecure default configuration. The vendor recommends updating to BlueSpice 5.2.7, which fixes all critical and high rated issues in the advisory, and checking installations for signs of misuse. Technical summary CVE-2026-25784 is an insecure default configuration (CWE-1188) in the bluespice/wiki container, where an internal authentication mechanism for services is reachable outside the internal container network, letting any user who can read the wiki obtain sysop privileges via the REST API; anonymous users on wikis with anonymous read access are also included. The advisory says the issue may date from BlueSpice 5.2.3, and affected versions are listed as 5.2.3 to 5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC. Fixed version is BlueSpice 5.2.7, with images re-published on 2026-10-19. CVE-2026-25716 (High, CVSS 4.0 7.1) is missing authorization (CWE-862) on user block and unblock endpoints in BlueSpiceUserManager, affecting 5.0.0 to 5.1.10 and 5.2.0 to 5.2.6, fixed in 5.1.11 and 5.2.7. Mitigations are stated for both issues: setting WIKI_SERVICE_TOKEN_AUTH_ALLOWED to the internal network range or blocking the /rest.php/mws/v1/app-token/generate path for the first, and blocking the bs-usermanager block paths for the second. Detection guidance includes reviewing access logs, Special:Log, ChatBot service user actions, and the block log. The advisory does not state a CVSS score for the three remaining CVEs beyond their assessed low rating, and it does not state exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from en.wiki.bluespice.com/wiki/Security:Sec…isories/BSSA-2026-07 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Hallo Welt! GmbH Hallo Welt! GmbH BlueSpice Hallo Welt! GmbH bluespice/wiki Hallo Welt! GmbH Extension:BlueSpiceUserManager Hallo Welt! GmbH bluespice/formula Hallo Welt! GmbH bluespice/search NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	High	7.1	CVE-2026-25716	Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock... Hallo Welt! GmbHHallo Welt! GmbH BlueSpice, Hallo Welt! GmbH BlueSpiceUserManager	NVD	Oct 23 09:17 UTC
CVE-2026-25716Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock... Executive summary A missing authorization flaw in the BlueSpice wiki user management extension (CVE-2026-25716) lets any logged-in user disable or re-enable accounts, including administrator accounts. The advisory rates this one High, and it is fixed in BlueSpice 5.1.11 and 5.2.7, which the vendor recommends installing. The same advisory also covers a critical flaw (CVE-2026-25784) that is fixed by the same 5.2.7 update. Technical summary The flaw is a missing authorization check (CWE-862) in the REST endpoints that Special:UserManager uses to block and unblock users, so any authenticated user can act on any account. The advisory says no content is changed and no data is disclosed, and that all block and unblock actions are logged in the block log. Affected versions are BlueSpice 5.0.0 – 5.1.10 and 5.2.0 – 5.2.6; fixed versions are BlueSpice 5.1.11 and BlueSpice 5.2.7, and the advisory says 5.0.x will not receive a fix. The advisory's workaround is to deny access to /rest.php/bs-usermanager/v1/block/create and /rest.php/bs-usermanager/v1/block/delete on the web server or reverse proxy, at the cost of disabling user enable/disable in Special:UserManager. The advisory does not state whether the issue is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from en.wiki.bluespice.com/wiki/Security:Sec…isories/BSSA-2026-07 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Hallo Welt! GmbH Hallo Welt! GmbH BlueSpice Hallo Welt! GmbH BlueSpiceUserManager NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	High	8.7	CVE-2026-16762	An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application... qtqt, Qt Core, qt QXmlStreamReader	NVD	Oct 23 09:17 UTC
CVE-2026-16762An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application... Executive summary The advisory is about CVE-2026-16762, a denial-of-service flaw in the Qt Core QXmlStreamReader XML parser that can make an application unresponsive when it parses a crafted XML document. The advisory describes the impact as limited to availability, with no data disclosure, data modification, or code execution, and it lists fixed versions of Qt for the affected branches. The text provided does not state a severity score, and the advisory's recommended action is to update to the fixed Qt versions. Technical summary The flaw is a denial-of-service issue caused by disproportionate CPU consumption while the QXmlStreamReader parser handles attacker-supplied XML. Exploitation needs no authentication, privileges, or user interaction beyond the application ingesting the input. Affected versions are stated as from Qt 4.3.0 to Qt 6.8.8 and from Qt 6.9.0 to Qt 6.11.1, with status before Qt 4.3.0 described as unknown. Fixed versions are Qt 6.8.9, Qt 6.11.2, and Qt 6.12.0. The advisory does not state a workaround, a CVSS score, or any detection guidance, and it does not say whether the issue is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wiki.qt.io/List_of_known_vulnerabilitie…ducts#CVE-2026-16762: Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:X Affects qt qt Qt Core qt QXmlStreamReader NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	4.8	CVE-2026-115657	When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup Apache, KNIMEApache Tomcat, KNIME Business Hub, KNIME Analytics Platform, KNIME Server, Apache Artemis	NVD	Oct 23 09:17 UTC
CVE-2026-115657When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup Executive summary This advisory page from KNIME covers many security issues across KNIME Analytics Platform, KNIME Server, and KNIME Business Hub, including the newest entries published in October 2026 and many older ones. The most recent items include credential logging in KNIME Analytics Platform used as an executor (CVSS v4.0 4.8, Medium) and several Medium issues in KNIME Business Hub, which the vendor says are fixed in version 1.19.0. The vendor recommends updating to the fixed versions listed for each issue. Technical summary The advisory lists many issues with different classes, including credential logging, missing cookie attributes, missing authorization checks, CSRF protection bypass via a forged X-Forwarded-Host header, excessive resource allocation, open redirect, and cross-site scripting. For CVE-2026-115657, KNIME Analytics Platform before 5.8.4 and 5.12.0 logs configured proxy credentials at startup when used as an executor, and an attacker with access to log files could reuse them; the advisory says there is no risk without an authenticated proxy, and fixed versions are LTS 5.8.4 and 5.12.0. For the KNIME Business Hub items, the fixed version is 1.19.0 for most CVEs, with workarounds stated for some (such as network policies or removing links without login) and not possible for others. For CVE-2026-4649, the advisory states Apache Artemis is affected, the fix is in Business Hub 1.18.0, 1.17.4, 1.16.3, and 1.15.2, and no workaround is known. Where the advisory does not state a workaround or detection guidance, this is not stated. Detection guidance is not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Summarized from knime.com/security/advisories Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Apache KNIME Apache Tomcat KNIME Business Hub KNIME Analytics Platform KNIME Server Apache Artemis NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112862	Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database:... xnau webdesignxnau webdesign Participants Database	NVD	Oct 23 09:17 UTC
CVE-2026-112862Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database:... Executive summary The Participants Database WordPress plugin by xnau webdesign, in versions up to and including 2.7.8.5, contains a PHP Object Injection flaw. The advisory rates it 9.8 on the CVSS scale and says it is highly dangerous and expected to be exploited, so administrators should treat it as urgent. The advisory recommends updating the plugin, and notes that no official patch was available at the time of publication. Technical summary The flaw is a deserialization of untrusted data vulnerability, classified as PHP Object Injection, which the advisory maps to OWASP A3: Injection. The advisory states that it requires no authentication, meaning an unauthenticated attacker may be able to exploit it, and it describes attackers manipulating how the site processes data to run harmful actions on the server. Vulnerable versions are stated as <= 2.7.8.5. The advisory says no official patch is available and does not state a fixed version. Patchstack has issued a mitigation rule that blocks attacks until an official patch is applied, and the advisory says to ask a hosting provider or developer for help if the plugin cannot be updated. Workarounds beyond this virtual patch and detection guidance beyond the mitigation rule are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects xnau webdesign xnau webdesign Participants Database NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Critical	9.3	CVE-2026-112860	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind... xnau webdesignxnau webdesign Participants Database	NVD	Oct 23 09:17 UTC
CVE-2026-112860Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind... From the advisory Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affects xnau webdesign xnau webdesign Participants Database NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	High	7.1	CVE-2026-112838	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects... e4jvikwp, VikRentCare4jvikwp VikRentCar, VikRentCar Plugin	NVD	Oct 23 09:17 UTC
CVE-2026-112838Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects... Executive summary A cross-site scripting flaw affects the VikRentCar plugin for WordPress, versions 1.4.8 and earlier. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The vendor's recommended fix is to update the plugin to version 1.4.9 or later. Technical summary The flaw is a stored cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation, mapped to OWASP A3: Injection. The advisory states that the required privilege is unauthenticated, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are listed as <= 1.4.8 and the patched version is 1.4.9. The advisory says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated. It does not state any other workaround, and no detection guidance is given beyond the mitigation rule. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects e4jvikwp VikRentCar e4jvikwp VikRentCar VikRentCar Plugin NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	High	8.5	CVE-2026-112837	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue... Ruben Garcia, GamiPressRuben Garcia GamiPress, GamiPress	NVD	Oct 23 09:17 UTC
CVE-2026-112837Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue... From the advisory Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L Affects Ruben Garcia GamiPress Ruben Garcia GamiPress GamiPress NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	High	7.1	CVE-2026-112835	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects... e4jvikwp, VikRentCare4jvikwp VikRentCar, VikRentCar Plugin	NVD	Oct 23 09:17 UTC
CVE-2026-112835Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects... Executive summary A cross-site scripting flaw affects the VikRentCar plugin for WordPress, versions 1.4.8 and earlier. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The recommended fix is to update the plugin to version 1.4.9 or later. Technical summary This is a reflected cross-site scripting (XSS) vulnerability, classified under OWASP A3: Injection, in the VikRentCar WordPress plugin. The advisory lists the required privilege as unauthenticated, but says exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page. Vulnerable versions are stated as <= 1.4.8, and the patched version is 1.4.9. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any further workarounds, and it gives no detection guidance beyond the mitigation rule. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…rability-2?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects e4jvikwp VikRentCar e4jvikwp VikRentCar VikRentCar Plugin NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	6.5	CVE-2026-112825	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. Car Rental Manager	NVD	Oct 23 09:17 UTC
CVE-2026-112825Missing Authorization vulnerability in Magepeople inc Executive summary A broken access control flaw in the Car Rental Manager WordPress plugin, made by Magepeople inc, lets low-privileged users reach actions they should not be able to perform. The advisory rates it medium severity with a CVSS score of 6.5 and says it is expected to be exploited. The vendor recommends updating the plugin to version 1.5.4 or later. Technical summary The vulnerability is a missing authorization or broken access control issue, classified as OWASP A1. The advisory states that versions 1.5.3 and earlier are vulnerable and that version 1.5.4 is patched. The required privilege is Subscriber, so an authenticated low-privileged account is the precondition for exploitation. The advisory says no mitigation rule can be assigned, so a virtual patch is not available, and it gives no other workaround beyond updating or asking a host or developer for help. Exploitation in the wild is not confirmed, though the advisory says it is expected to be exploited. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Magepeople inc.Magepeople inc. Car Rental Manager NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary