2026

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parse_dacl()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix race condition during devi

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu lis

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipc_named_node_up() on emp

In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE

In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't cast tpacket_hdr.tp_len to int in

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirty_lock IRQ-safe fbtft_mkd

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_clo

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioc_list memory leak durin

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgro

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization h

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as sc

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark sched_process_wait argument as nullable

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference c

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix init_config acce

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same s

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpx

Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message d

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is c

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored deta

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address heade

A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in v

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is v

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPres

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in a

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters i

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnera

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stor

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to gene

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all ve

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Sc

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting vi

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling b

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a gen

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the ad

The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorizat

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular e

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for exp

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbo

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlle

A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. A