{"resultsPerPage":259,"startIndex":0,"totalResults":259,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-02T03:24:14.331","vulnerabilities":[{"cve":{"id":"CVE-2026-15142","sourceIdentifier":"security@wordfence.com","published":"2026-08-15T09:16:28.557","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"WebCodingPlace","product":"Real Estate Manager Pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"12.8.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:14:05.869940Z","id":"CVE-2026-15142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://wp-rem.com/changelog/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e9ff91-4137-4c66-959b-f4ffb8d3ba32?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16142","sourceIdentifier":"security@wordfence.com","published":"2026-08-15T09:16:29.560","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themetechmount","product":"TrueBooker – Appointment Booking and Scheduler System","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:43:36.002344Z","id":"CVE-2026-16142","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-booking","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d3f7cb-4974-4b0f-9658-1895e5966276?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18438","sourceIdentifier":"security@wordfence.com","published":"2026-08-15T10:16:29.413","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capability requirement. The same permission gate also allows a contributor to overwrite the site's global Templately cloud connection via the /templately/v1/login endpoint with global_signin set to true. A complete remediation should both correct fetch_remote_file to validate the file type against the actual destination filename rather than the Content-Disposition header (and avoid deriving the write path from the request URL), and restrict state-changing Templately REST routes to an appropriate administrator-level capability."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpdevteam","product":"Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:26:10.332711Z","id":"CVE-2026-18438","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.6.5/includes/API/API.php#L128","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.6.5/includes/API/Import.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.6.5/includes/API/MyClouds.php#L103","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.6.5/includes/Core/Importer/WPImport.php#L1200","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.6.5/includes/Core/Importer/WPImport.php#L1391","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.6.5/includes/Core/Importer/WPImport.php#L1423","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.6.5/includes/Core/Platform/Gutenberg.php#L177","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.7.1/includes/API/API.php#L128","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.7.1/includes/API/Import.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.7.1/includes/API/MyClouds.php#L103","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.7.1/includes/Core/Importer/WPImport.php#L1200","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.7.1/includes/Core/Importer/WPImport.php#L1391","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.7.1/includes/Core/Importer/WPImport.php#L1423","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.7.1/includes/Core/Platform/Gutenberg.php#L177","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3636643/templately/trunk/includes/Core/Importer/WPImport.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Ftemplately/tags/3.7.1&new_path=%2Ftemplately/tags/3.7.2","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3636643%40templately%2Ftags%2F3.7.2&old=3624408%40templately%2Ftags%2F3.7.1","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e68b2f2-12e4-4ff2-919d-26d6b21acd03?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19891","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T11:16:26.340","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchange_mode causes missing encryption of sensitive data. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TRENDnet","product":"TEW-WLC100","cpes":["cpe:2.3:a:trendnet:tew-wlc100:*:*:*:*:*:*:*:*"],"modules":["IKE Phase 1 Aggressive Mode"],"versions":[{"version":"2.05b02","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:50:51.155971Z","id":"CVE-2026-19891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-310"},{"lang":"en","value":"CWE-311"}]}],"references":[{"url":"https://app.notion.com/p/TEW-WLC100-2-05b02-38b1f5ba989080f993facb660f17358e?source=copy_link","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19891","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870587","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390080","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390080/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-73631","sourceIdentifier":"security@apache.org","published":"2026-08-15T11:16:27.227","lastModified":"2026-08-18T17:47:40.480","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.\n\nThis issue affects Apache Struts: 7.2.1.\n\nUsers are recommended to upgrade to version 7.3.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","packageName":"org.apache.struts:struts2-json-plugin","versions":[{"version":"7.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T12:42:07.654513Z","id":"CVE-2026-73631","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-567"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:7.2.1:*:*:*:*:*:*:*","matchCriteriaId":"5B413DED-A87F-4793-A0DC-7D11B1C7A6BE"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-070","source":"security@apache.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73632","sourceIdentifier":"security@apache.org","published":"2026-08-15T11:16:27.330","lastModified":"2026-08-18T17:47:08.787","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.\n\nThis issue affects Apache Struts: 7.2.1.\n\nUsers are recommended to upgrade to version 7.3.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","packageName":"org.apache.struts:struts2-json-plugin","versions":[{"version":"7.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T12:40:26.178330Z","id":"CVE-2026-73632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-567"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:7.2.1:*:*:*:*:*:*:*","matchCriteriaId":"5B413DED-A87F-4793-A0DC-7D11B1C7A6BE"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-071","source":"security@apache.org","tags":["Vendor Advisory","Mitigation"]}]}},{"cve":{"id":"CVE-2026-73634","sourceIdentifier":"security@apache.org","published":"2026-08-15T11:16:27.427","lastModified":"2026-08-18T17:46:04.070","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected.\n\nThis issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.\n\nUsers are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","packageName":"org.apache.struts:struts2-core","versions":[{"version":"6.0.0","lessThanOrEqual":"6.10.0","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T12:44:33.927001Z","id":"CVE-2026-73634","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.11.0","matchCriteriaId":"3BC456E1-1D13-404B-A50F-A9DA579309F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.3.0","matchCriteriaId":"54C39F3E-9829-4AB5-80DD-920D4F86ED0E"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-073","source":"security@apache.org","tags":["Vendor Advisory","Mitigation"]}]}},{"cve":{"id":"CVE-2026-73635","sourceIdentifier":"security@apache.org","published":"2026-08-15T11:16:27.540","lastModified":"2026-08-18T17:45:16.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.\n\nUsers are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","packageName":"org.apache.struts:struts2-core","versions":[{"version":"2.0.0","lessThanOrEqual":"2.3.37","versionType":"semver","status":"affected"},{"version":"2.5.0","lessThanOrEqual":"2.5.33","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThanOrEqual":"6.10.0","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T12:43:09.201224Z","id":"CVE-2026-73635","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndIncluding":"2.3.37","matchCriteriaId":"AB32EC52-8599-4E6C-9F87-D2BC050A2531"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndIncluding":"2.5.33","matchCriteriaId":"52DA80BB-35F0-4290-902F-66D27FB9A98F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.11.0","matchCriteriaId":"3BC456E1-1D13-404B-A50F-A9DA579309F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.3.0","matchCriteriaId":"54C39F3E-9829-4AB5-80DD-920D4F86ED0E"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-074","source":"security@apache.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-12248","sourceIdentifier":"security@wordfence.com","published":"2026-08-15T12:16:31.713","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with translator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"WPML","product":"WPML Multilingual CMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:28:40.687819Z","id":"CVE-2026-12248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/sitepress-multilingual-cms/tags/4.9.2/classes/API/REST/class-wpml-tm-rest-jobs.php#L144","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sitepress-multilingual-cms/tags/4.9.2/classes/jobs/query/OrderQueryHelper.php#L34","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sitepress-multilingual-cms/trunk/classes/API/REST/class-wpml-tm-rest-jobs.php#L144","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sitepress-multilingual-cms/trunk/classes/jobs/query/OrderQueryHelper.php#L34","source":"security@wordfence.com"},{"url":"https://wpml.org/category/changelog/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/781b00cd-3af9-432a-876b-bff482106ab0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19893","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T12:16:32.543","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"D-Link","product":"DIR-842","cpes":["cpe:2.3:h:d-link:dir-842:*:*:*:*:*:*:*:*"],"modules":["vsftpd"],"versions":[{"version":"2.01.B04","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:N/I:P/A:N","baseScore":2.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T13:07:26.555752Z","id":"CVE-2026-19893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-276"}]}],"references":[{"url":"https://app.notion.com/p/DIR-842-2-01-B04-38b1f5ba98908074af60fc69628dfb71?source=copy_link","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19893","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870588","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390081","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390081/cti","source":"cna@vuldb.com"},{"url":"https://www.dlink.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19894","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T13:17:48.153","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Hospital Management System","cpes":["cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-19T15:52:44.742073Z","id":"CVE-2026-19894","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit_vuln/issues/18","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19894","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870604","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390082","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390082/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-73193","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-08-15T13:17:48.327","lastModified":"2026-08-28T15:42:20.060","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse.\n\npreparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content.\n\nAny caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"DBI","modules":["DBI"],"programFiles":["DBI.xs"],"programRoutines":[{"name":"preparse"}],"repo":"https://github.com/perl5-dbi/dbi","packageURL":"pkg:cpan/DBI","versions":[{"version":"0","lessThan":"1.652","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:30:59.439025Z","id":"CVE-2026-73193","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wj3v-c3hh-mhqr","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14739","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wj3v-c3hh-mhqr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73194","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-08-15T13:17:48.433","lastModified":"2026-08-28T15:42:20.060","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.\n\npreparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, \":p%d\", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.\n\nAny caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"DBI","modules":["DBI"],"programFiles":["DBI.xs"],"programRoutines":[{"name":"preparse"}],"repo":"https://github.com/perl5-dbi/dbi","packageURL":"pkg:cpan/DBI","versions":[{"version":"0","lessThan":"1.652","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:29:15.870047Z","id":"CVE-2026-73194","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-787"},{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-623j-hfpc-mrc4","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10879","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14739","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-74440","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:48.540","lastModified":"2026-08-17T06:19:39.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Wait on external BO kernel fences in exec IOCTL\n\nBefore arming a user job, xe_exec_ioctl() only added the VM's\ndma-resv KERNEL slot as a dependency. That slot covers rebinds and\nthe kernel operations of the VM's private BOs, but not external BOs\n(bo->vm == NULL), which carry their kernel operations (evictions,\nmoves, ...) in their own dma-resv KERNEL slot.\n\nThe DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for\nmemory management operations that must complete before the BO or its\nbacking store may be used: any accessor is required to wait on the\nKERNEL fences before touching the resv. By skipping the external BOs'\nKERNEL slots, the exec path violated that contract and could schedule\na user job while a kernel operation on an external BO mapped by the VM\nwas still in flight, racing against it and potentially reading or\nwriting memory that was being moved.\n\nReplace the VM-only dependency with an iteration over every object\nlocked by the exec, adding each object's KERNEL slot as a job\ndependency. This covers the VM resv (rebinds and private BOs) as well\nas every external BO, mirroring the drm_gpuvm_resv_add_fence() call\nthat later publishes the job fence to the same set of objects.\nLong-running mode continues to skip this, as before.\n\n(cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/xe_exec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"1738db550334adca0e7fcf0ef684198fb7462779","versionType":"git","status":"affected"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"21976fe5258494ac38b63d103be81bf1180ae4ae","versionType":"git","status":"affected"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"5d363d00bc9799b90a0dc89eb1c5dcb909c042ee","versionType":"git","status":"affected"},{"version":"dd08ebf6c3525a7ea2186e636df064ea47281987","lessThan":"af80e2bfde9312c76b60cf9274248dce0410b30d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/xe_exec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1738db550334adca0e7fcf0ef684198fb7462779","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21976fe5258494ac38b63d103be81bf1180ae4ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d363d00bc9799b90a0dc89eb1c5dcb909c042ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af80e2bfde9312c76b60cf9274248dce0410b30d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74441","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:48.643","lastModified":"2026-08-23T13:16:43.717","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Fix race condition and ordering in port unregistration\n\nA synchronization issue exists during port unregistration where pending\npartner work items can race against workqueue destruction, leading to\nuse-after-free conditions:\n\n  cros_ec_ucsi cros_ec_ucsi.3.auto: error -ETIMEDOUT: PPM init failed\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  RIP: 0010:__queue_work+0x83/0x4a0\n  Call Trace:\n    <IRQ>\n    __cfi_delayed_work_timer_fn+0x10/0x10\n    run_timer_softirq+0x3b6/0xbd0\n    sched_clock_cpu+0xc/0x110\n    irq_exit_rcu+0x18d/0x330\n    fred_sysvec_apic_timer_interrupt+0x5e/0x80\n\nFix this by ensuring strict ordering and proper serialization during\nteardown:\n\n1. Move ucsi_unregister_partner() to the beginning of the teardown\nsequence and protect it under the connector mutex lock.\n2. Ensure all pending partner tasks are explicitly flushed and finished\nbefore the workqueue is destroyed.\n3. Switch from mod_delayed_work() to a cancel_delayed_work() and\nqueue_delayed_work() sequence. This guarantees that items currently marked\nas pending won't be scheduled an additional time, preventing a double\nrelease of resources which leads to the following crash:\n\n  Oops: general protection fault, probably for non-canonical address\n    0xdead000000000122: 0000 [#1] SMP NOPTI\n  Workqueue: cros_ec_ucsi.3.auto-con2 ucsi_poll_worker\n  RIP: 0010:ucsi_poll_worker+0x65/0x1e0\n  Call Trace:\n  <TASK>\n    process_scheduled_works+0x218/0x6d0\n    worker_thread+0x188/0x3f0\n    __cfi_worker_thread+0x10/0x10\n    kthread+0x226/0x2a0\n\nTo ensure these rules are applied identically across both the normal\nteardown and the ucsi_init() error paths, consolidate the cleanup logic\ninto a new helper, ucsi_unregister_port()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b9aa02ca39a49740926c2c450a1505a4a0f8954a","lessThan":"7b63c680ff605f60f056e5f2c323f1a602aee182","versionType":"git","status":"affected"},{"version":"b9aa02ca39a49740926c2c450a1505a4a0f8954a","lessThan":"07f8aaffee705e552c1f723ac8bf7eb137ad59c2","versionType":"git","status":"affected"},{"version":"b9aa02ca39a49740926c2c450a1505a4a0f8954a","lessThan":"11483d80267db97fbe49f2df66385434256cc3b0","versionType":"git","status":"affected"},{"version":"b9aa02ca39a49740926c2c450a1505a4a0f8954a","lessThan":"3f7b3728dd9011c915cbeaea77274ebe8366550d","versionType":"git","status":"affected"},{"version":"b9aa02ca39a49740926c2c450a1505a4a0f8954a","lessThan":"bc7a0f721123ea260a42f1ded06dab844ba49434","versionType":"git","status":"affected"},{"version":"b9aa02ca39a49740926c2c450a1505a4a0f8954a","lessThan":"7aa7d4bf9d3fa9a6a47b640ad103ab433b7ff261","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/07f8aaffee705e552c1f723ac8bf7eb137ad59c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/11483d80267db97fbe49f2df66385434256cc3b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f7b3728dd9011c915cbeaea77274ebe8366550d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7aa7d4bf9d3fa9a6a47b640ad103ab433b7ff261","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b63c680ff605f60f056e5f2c323f1a602aee182","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc7a0f721123ea260a42f1ded06dab844ba49434","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74442","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:48.760","lastModified":"2026-08-17T06:19:39.970","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure\n\nTwo paths through vmw_vkms_init() can leave vmw->crc_workq NULL while\nstill leaving the rest of the driver in a state that calls\nvmw_vkms_cleanup() at module unload:\n\n  1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or\n     returning an oversized buffer -- the common case on hosts\n     without a VBLANK guestinfo entry -- early-returned before the\n     workqueue allocation.\n  2. alloc_ordered_workqueue() returning NULL on memory pressure.\n\nvmw_vkms_cleanup() then calls destroy_workqueue(NULL), which\ndereferences wq->name and panics.\n\nFix the first case by removing the early return: vmw->vkms_enabled\nis already false on the rpci-failure path so no work will ever be\nqueued, and allocating the workqueue unconditionally keeps the\ncontrol flow simple.  Fix the second case by guarding the cleanup\nwith a NULL check, since alloc_ordered_workqueue() can still fail\nunder low memory."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7b0062036c3b71b4a69e244ecf0502c06c4cf5f0","lessThan":"7c701778c6a369769992614dac8dc00c8ac72afc","versionType":"git","status":"affected"},{"version":"7b0062036c3b71b4a69e244ecf0502c06c4cf5f0","lessThan":"96efee36453b697ccbaf75091b7a1807c11809dd","versionType":"git","status":"affected"},{"version":"7b0062036c3b71b4a69e244ecf0502c06c4cf5f0","lessThan":"0ee0532f1d405d37f38c44cbba87342e63d3bbd4","versionType":"git","status":"affected"},{"version":"7b0062036c3b71b4a69e244ecf0502c06c4cf5f0","lessThan":"05eaa887e7b4f40fba425f8a1d7a5a8a043092a6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05eaa887e7b4f40fba425f8a1d7a5a8a043092a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0ee0532f1d405d37f38c44cbba87342e63d3bbd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c701778c6a369769992614dac8dc00c8ac72afc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96efee36453b697ccbaf75091b7a1807c11809dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74443","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:48.863","lastModified":"2026-08-19T17:21:01.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"eb20f418933bea53375843b27b4022c1810be63b","versionType":"git","status":"affected"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"fcd1e56e7816b31a1050ccc67df722b20f6bb15d","versionType":"git","status":"affected"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"a4a37080a5ac777b59306cfcdf854cc05d7604d4","versionType":"git","status":"affected"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"036e16ada95389bdc30f41068af04c1d0872fad0","versionType":"git","status":"affected"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","versionType":"git","status":"affected"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","versionType":"git","status":"affected"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"9759da60e38d7b9db44dc92713e4e0391883d221","versionType":"git","status":"affected"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"f4f1db96bfd68b81053693ba53405b6f510ac16c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74444","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:48.963","lastModified":"2026-08-19T17:21:01.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);\n\nwhere header->size is u32 and is taken straight from the user-supplied\ncommand stream.  When header->size is less than sizeof(cmd->body) the\nunsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.\nAny user-controlled cmd->body.numVertexDecls then passes the bound and\nthe loop dereferences decl[i] far past the end of the kernel command\nbounce buffer, producing an out-of-bounds read of kernel memory.\n\nReject undersized headers up front."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"b89ca4bba820f79dde52af15ee139fe6e8bbc314","versionType":"git","status":"affected"},{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"bef30317fcb4c838a37bceb2fc76256eb6b975c1","versionType":"git","status":"affected"},{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"112c6ff29a56f3a22db4d5af869697aa07035ad6","versionType":"git","status":"affected"},{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"2666cddf0dd218aa9bd1f99db688d1b532eac21a","versionType":"git","status":"affected"},{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"fc0c02f510e41650df3479f96e257acf87d8a20a","versionType":"git","status":"affected"},{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"dc0be7662b7b0ce28cb5eea864737793ed7b9e70","versionType":"git","status":"affected"},{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"c77cf8edae2bd3a1599115301cc7c98d0c78e731","versionType":"git","status":"affected"},{"version":"7a73ba7469cbea631050094fd14f73acebb97cf9","lessThan":"85891d174707d8bddcec7a888fb4e1d17def34f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74445","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.067","lastModified":"2026-08-17T06:19:40.303","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: reject DX_BIND_QUERY without a DX context\n\nvmw_cmd_dx_bind_query() unconditionally dereferences\nsw_context->dx_ctx_node->ctx.  Userspace can trigger a NULL pointer\ndereference from any render-node fd by submitting an execbuf with\ndx_context_handle == SVGA3D_INVALID_ID and a SVGA_3D_CMD_DX_BIND_QUERY\nopcode in the command stream: dx_ctx_node is left NULL and the kernel\noopses on the assignment.  The same NULL is then re-read in\nvmw_resources_reserve() via vmw_context_get_dx_query_mob().\n\nAll sibling DX handlers fail-close on a missing dx_ctx_node using\nVMW_GET_CTX_NODE().  Use the same pattern here, returning -EINVAL up\nfront before any relocation state is published."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9c079b8ce8bf8e0394149eb39c78b04285644bcc","lessThan":"7eae011829f94a76470ec76f016805f508437755","versionType":"git","status":"affected"},{"version":"9c079b8ce8bf8e0394149eb39c78b04285644bcc","lessThan":"0634d50e8b398c25bd07c96b048e484d22688c26","versionType":"git","status":"affected"},{"version":"9c079b8ce8bf8e0394149eb39c78b04285644bcc","lessThan":"e479240a1e076ba1104236331abd62400bf1d495","versionType":"git","status":"affected"},{"version":"9c079b8ce8bf8e0394149eb39c78b04285644bcc","lessThan":"6b1eb0b63cc153e1c0cb5ab8350950119be11947","versionType":"git","status":"affected"},{"version":"9c079b8ce8bf8e0394149eb39c78b04285644bcc","lessThan":"55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0634d50e8b398c25bd07c96b048e484d22688c26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55ec09c9ce10b1272802c7ab6c1be2ea0dbc68db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b1eb0b63cc153e1c0cb5ab8350950119be11947","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7eae011829f94a76470ec76f016805f508437755","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e479240a1e076ba1104236331abd62400bf1d495","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74446","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.180","lastModified":"2026-08-19T17:21:01.813","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: hold event_mutex while checkpointing CRIU events\n\nkfd_criu_checkpoint_events() counts the entries in p->event_idr via\nkfd_get_num_events(), allocates an array sized to that count, and then\nwalks the same IDR to fill it. Neither the count nor the walk holds\np->event_mutex.\n\nThe CRIU checkpoint caller holds only p->mutex. Event create and destroy\n(kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not\ntake p->mutex, so a second thread in the same process can insert or remove\nevents between the count and the walk. If an event is inserted, the walk\niterates more entries than were counted and writes past the end of the\nev_privs allocation; if an event is removed, the walk dereferences an\nentry that is being freed.\n\nHold p->event_mutex across the count and the walk so both observe a\nconsistent view of p->event_idr. The lock is released before\ncopy_to_user(), which only touches the local buffer. The caller already\nholds p->mutex and the create/destroy paths never take p->mutex, so the\np->mutex -> p->event_mutex order is not inverted and no deadlock is\nintroduced.\n\n(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"40e8a766a761f7fdc8530347527b344fddf6f1a8","lessThan":"8f7196f25b14f4290738639a50459b56a5ff2784","versionType":"git","status":"affected"},{"version":"40e8a766a761f7fdc8530347527b344fddf6f1a8","lessThan":"2040b7e39027cb83bb8c7b84a4c95c2f6053c32f","versionType":"git","status":"affected"},{"version":"40e8a766a761f7fdc8530347527b344fddf6f1a8","lessThan":"9a7f765985f64fd4a7a58f7bc9cd80a1f4230628","versionType":"git","status":"affected"},{"version":"40e8a766a761f7fdc8530347527b344fddf6f1a8","lessThan":"6a52f48157fa7fb81e0c146937fd6c8b0c1cfdbd","versionType":"git","status":"affected"},{"version":"40e8a766a761f7fdc8530347527b344fddf6f1a8","lessThan":"bed80be08c0bee47fa242a4256ac873477c815f8","versionType":"git","status":"affected"},{"version":"40e8a766a761f7fdc8530347527b344fddf6f1a8","lessThan":"ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2040b7e39027cb83bb8c7b84a4c95c2f6053c32f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a52f48157fa7fb81e0c146937fd6c8b0c1cfdbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f7196f25b14f4290738639a50459b56a5ff2784","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a7f765985f64fd4a7a58f7bc9cd80a1f4230628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bed80be08c0bee47fa242a4256ac873477c815f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74447","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.287","lastModified":"2026-08-17T06:19:40.513","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment\n\neop_ring_buffer_size in struct queue_properties is a u32. In\nkfd_queue_acquire_buffers() the expected EOP buffer size is computed as\nALIGN(eop_ring_buffer_size, PAGE_SIZE); ALIGN uses typeof(x), so the\naddition is done in 32-bit. A user-supplied size of 0xFFFFF001 wraps to\n0, causing kfd_queue_buffer_get() to skip its exact-size check (gated on\nsize != 0) and accept any BO mapped at the address. On GFX8/GFX9 the MQD\ncp_hqd_eop_control is then programmed for an 8KB EOP ring backed by a 4KB\nBO, so CP EOP writes can land past the buffer and fault the GPU.\n\nCast the operand to u64 so the alignment is computed in 64-bit; the size\ncheck in kfd_queue_buffer_get() then rejects the oversized request.\n\n(cherry picked from commit ae443117b742c357bfef3a7bddabf76fcf86e9ef)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ee0dc6c66a913260311876a4b2b53fe0b9bc3f94","lessThan":"273548eb997c6be85230c1236b18784b09f6203c","versionType":"git","status":"affected"},{"version":"acfc84cfa70aca5b970faf152979bc97b9f8b0c0","lessThan":"6dc0b4b39ed4f11ef70f76ecea8537e35f45342b","versionType":"git","status":"affected"},{"version":"42ea9cf2f16b7131cb7302acb3dac510968f8bdc","lessThan":"7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961","versionType":"git","status":"affected"},{"version":"42ea9cf2f16b7131cb7302acb3dac510968f8bdc","lessThan":"83463a96ea3c7d8ae636a4d6a0ba63c9ce410724","versionType":"git","status":"affected"},{"version":"c6ce687077cc67e4f3cbd0c89cb356fbbce91f4c","versionType":"git","status":"affected"},{"version":"6.12.75","lessThan":"6.12.103","versionType":"semver","status":"affected"},{"version":"6.18.16","lessThan":"6.18.44","versionType":"semver","status":"affected"},{"version":"6.19.6","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/273548eb997c6be85230c1236b18784b09f6203c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6dc0b4b39ed4f11ef70f76ecea8537e35f45342b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c54bd225d83bc1bcb44430ed4b4d3a5c36b1961","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83463a96ea3c7d8ae636a4d6a0ba63c9ce410724","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74448","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.390","lastModified":"2026-08-18T07:16:54.720","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix QID bit leak in pqm_create_queue()\n\nWhen MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during\nthe first queue creation for a process, pqm_create_queue() returns\nearly via 'return retval' without going through the err_create_queue\ncleanup label.\n\nThis means clear_bit(*qid, pqm->queue_slot_bitmap) is never called,\nleaving the reserved QID bit permanently set in queue_slot_bitmap.\nOver time this leaks QID slots, potentially exhausting all available\nqueue slots.\n\nFix this by replacing 'return retval' with 'goto err_allocate_pqn'\nso that clear_bit() is always called on the error path without\ntouching the uninitialized pqn pointer.\n\nAILIKFD-813\n\n(cherry picked from commit a107f74c38edbb80d6ab64dcaeeb292c14e9779f)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0f88894aa628680747ae27760e5f627f901a435f","lessThan":"8924e2594a15bdbd07f8696770864366d787ab70","versionType":"git","status":"affected"},{"version":"c0ef1c8ef70bfa3487ea84f794d7a1f0fea0735d","lessThan":"2ff5bb3645c72b3690e70c513a62a86600c4632f","versionType":"git","status":"affected"},{"version":"fddc45026311c05a5355fd34b9dc0a1d7eaef4a2","lessThan":"5f0f2ddeac738e2ca9d12cb76a1ff2904e85ecc3","versionType":"git","status":"affected"},{"version":"fddc45026311c05a5355fd34b9dc0a1d7eaef4a2","lessThan":"7c35bf94150d872e670a6632aa819d320279effb","versionType":"git","status":"affected"},{"version":"fddc45026311c05a5355fd34b9dc0a1d7eaef4a2","lessThan":"38b73293f38658a4685ffcea666462024f858ad9","versionType":"git","status":"affected"},{"version":"9d61e2b81f5fc90c87975879809346e7c90ea5f9","versionType":"git","status":"affected"},{"version":"d86ba913bbfd1afafacbfb750001ffc6bfe29da0","versionType":"git","status":"affected"},{"version":"6.6.87","lessThan":"6.6.151","versionType":"semver","status":"affected"},{"version":"6.12.23","lessThan":"6.12.103","versionType":"semver","status":"affected"},{"version":"6.13.11","lessThan":"6.14","versionType":"semver","status":"affected"},{"version":"6.14.2","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2ff5bb3645c72b3690e70c513a62a86600c4632f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38b73293f38658a4685ffcea666462024f858ad9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f0f2ddeac738e2ca9d12cb76a1ff2904e85ecc3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c35bf94150d872e670a6632aa819d320279effb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8924e2594a15bdbd07f8696770864366d787ab70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74449","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.500","lastModified":"2026-08-18T07:16:54.827","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport\n\nIf a plane reaches calculate_mcache_setting with a zero-area viewport,\ncalculate_mcache_setting exits early with num_mcaches == 0 and\nmvmpg_width/height == 0. This will cause a divide-by-zero panic and can\nalso cause an underflow on num_mcaches.\n\nFix this by changing calculate_mcache_setting to bool and adding guards\nafter each calculate_mcache_row_bytes call. If num_mcaches or\nmvmpg_width/height is zero, return a false. Callers will propagate the\nfailure as a rejected mode, which prevents the panic.\n\n(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"70839da6360500a82e4d5f78499284474cbed7c1","lessThan":"1f93537881fd22712732a60ad12572a3fd40c0ec","versionType":"git","status":"affected"},{"version":"70839da6360500a82e4d5f78499284474cbed7c1","lessThan":"f327e389c07cfc3a2f6ff54f6214e1a52d457edc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1f93537881fd22712732a60ad12572a3fd40c0ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74450","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.593","lastModified":"2026-08-23T13:16:43.837","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix pptable use-after-free\n\namdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table\nafter dropping adev->pm.mutex. The sysfs path then copies from that pointer.\nA concurrent pp_table write can replace and free the allocation during the\ncopy, causing a use-after-free.\n\nChange the DPM interface to copy into caller-provided storage while the mutex\nis held. Keep the size-only query for attribute discovery without exposing\nthe driver-owned pointer.\n\n(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/pm/amdgpu_dpm.c","drivers/gpu/drm/amd/pm/amdgpu_pm.c","drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1684d3ba488529266ce6f97b88076bd185f4790e","lessThan":"3fbb3ac75000e3187f500a91a4099b24206866a1","versionType":"git","status":"affected"},{"version":"1684d3ba488529266ce6f97b88076bd185f4790e","lessThan":"9efc767335234cf7a892e46d45cd453b711421e7","versionType":"git","status":"affected"},{"version":"1684d3ba488529266ce6f97b88076bd185f4790e","lessThan":"81b5af1fb0f14cace6c3b3130a05e5602a597820","versionType":"git","status":"affected"},{"version":"1684d3ba488529266ce6f97b88076bd185f4790e","lessThan":"8c685df5c3b261c42505110965b42f9a754eb9b7","versionType":"git","status":"affected"},{"version":"1684d3ba488529266ce6f97b88076bd185f4790e","lessThan":"b628f2c6feb3a115ea72d3120a2bd94afc5163df","versionType":"git","status":"affected"},{"version":"1684d3ba488529266ce6f97b88076bd185f4790e","lessThan":"bb493058c35c8676e48269ab6732688ea733d23c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/pm/amdgpu_dpm.c","drivers/gpu/drm/amd/pm/amdgpu_pm.c","drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3fbb3ac75000e3187f500a91a4099b24206866a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81b5af1fb0f14cace6c3b3130a05e5602a597820","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c685df5c3b261c42505110965b42f9a754eb9b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9efc767335234cf7a892e46d45cd453b711421e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b628f2c6feb3a115ea72d3120a2bd94afc5163df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb493058c35c8676e48269ab6732688ea733d23c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74451","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.697","lastModified":"2026-08-17T06:19:40.953","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate firmware interface structure sizes\n\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\n\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/panthor/panthor_fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"21c77486f5a60bb9c0433c21de62a5f25d5091f1","versionType":"git","status":"affected"},{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"c835f2b0b7167584832b516c9b0a26e9180d1d0b","versionType":"git","status":"affected"},{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"ca41d9f3a21586bf29df53eec05152ecf2b2f94f","versionType":"git","status":"affected"},{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"b921b8613790a3f9e78ab64017fa7149ef0b750c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/panthor/panthor_fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74452","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.790","lastModified":"2026-08-17T06:19:41.070","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: reject firmware sections with oversized data\n\nIn panthor_fw_load_section_entry(), the data size to copy is calculated\nwithout validating it against the allocated section_size:\n\n    section->data.size = hdr.data.end - hdr.data.start;\n\nIf a crafted firmware sets data.size larger than the allocated memory,\nthis could cause a heap buffer overflow in panthor_fw_init_section_mem()\n\n    memcpy(section->mem->kmap, section->data.buf, section->data.size);\n\nAdditionally, if the section->data.size exceeds the BO size, could this\nmemset underflow the size calculation, leading to a massive out-of-bounds\nzeroing of kernel memory?\n\n    memset(section->mem->kmap + section->data.size, 0,\n           panthor_kernel_bo_size(section->mem) - section->data.size);\n\nReject section entries whose initial data is larger than the section size."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/panthor/panthor_fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"0e57165ca025a67d8dfd17efd2765fdd4925fdab","versionType":"git","status":"affected"},{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"2a761b9be5863e1d26a584f0c2d1e114a684ed9a","versionType":"git","status":"affected"},{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"7f4674d986c15c74327cb6ac6e2e2afecf061e04","versionType":"git","status":"affected"},{"version":"2718d91816eeed03c09c8abe872e45f59078768c","lessThan":"a3caaa06809248b996254be5b47e10804a3494e2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/panthor/panthor_fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e57165ca025a67d8dfd17efd2765fdd4925fdab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a761b9be5863e1d26a584f0c2d1e114a684ed9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f4674d986c15c74327cb6ac6e2e2afecf061e04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3caaa06809248b996254be5b47e10804a3494e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74453","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:49.893","lastModified":"2026-08-19T17:21:01.953","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Zero the tile state data array before each BIN job\n\nThe binner BO is a single 16MB buffer split into 512KB slots that are\nhanded out to jobs at submission time and recycled as jobs complete,\nwithout ever being cleared. Each slot holds the job's Tile State Data\nArray (TSDA) at its start, followed by the tile allocation pool.\n\nWhile the tile allocation pool is only walked by the render thread\nthrough branches the binner generated during the current job, the\nTSDA is the PTB's own per-tile bookkeeping and is consumed by the\nhardware itself. Although the kernel sets the \"Auto-initialise Tile\nState Data Array\" flag in the tile binning mode configuration, the\nPTB demonstrably still acts on stale tile state left by the slot's\nprevious user: the binner ends up creating invalid command streams\nwith invalid primitive streams and branches, which can cause GPU hangs\nas observed in [1][2].\n\nZero the TSDA when the job's binning slot is configured. This clears\n48 bytes per tile (~24KB for a 1080p frame) in the submission path, and\nguarantees the PTB never sees another job's tile state.\n\nThe tile count is only checked for being non-zero today, so the 8-bit\nfields it comes from can describe a tile state array almost six times\nlarger than the slot it has to live in. Bound it before the slot is\nhanded out, since such size decides how much of the slot is left for\nthe tile alloc pool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/vc4/vc4_validate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"c5d8e8e1a8e3b4e464683c5a8a869c16a6382fea","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"d3677372e0275e139f0efd2872c5a524b5d12868","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"c8dea7e7c6098e383e44f21a64d0431da5480e3f","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"f5802be65535f8818af7191159cf8c11f48ab2a2","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"0e858422df2334165293ea742da9fbb2e51f2739","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"57667eb7548faaac396c6e39f3b4444dab5b097c","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"a75c8f365e209aa9bb927b0942a7840152d44892","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"48a570c964d8e37d353381e4195106277e17f5cb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/vc4/vc4_validate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e858422df2334165293ea742da9fbb2e51f2739","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48a570c964d8e37d353381e4195106277e17f5cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57667eb7548faaac396c6e39f3b4444dab5b097c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a75c8f365e209aa9bb927b0942a7840152d44892","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5d8e8e1a8e3b4e464683c5a8a869c16a6382fea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8dea7e7c6098e383e44f21a64d0431da5480e3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3677372e0275e139f0efd2872c5a524b5d12868","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5802be65535f8818af7191159cf8c11f48ab2a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74454","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.003","lastModified":"2026-08-19T17:21:02.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\n\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\nout-of-memory event the PTB is therefore authorized to write tile lists\nacross all the other slots (which may hold the tile state, tile alloc and\noverflow memory of in-flight jobs) and, for any slot but the first, past\nthe end of the binner BO into unrelated CMA memory.\n\nSince CMA pages are recycled into page cache and user allocations, this\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\nhangs with corrupted control list pointers, userspace heap corruption, a\nGPU that stays permanently wedged after the first hang, and occasional\nfull system crashes, whenever a job overflows the initial binner slot.\n\nThe bug dates back to the conversion from a dedicated overflow BO (where\nwriting the full BO size was correct) to the slotted binner BO."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/vc4/vc4_irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"bb5656ae063f2711f56438cf2f1f5b613aea5f12","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"2f2291a119e9a8b696ae8bb36e86b75d272ceaea","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"0badb30871004d34df87be33e853536f0b69885f","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"6cd5acf6f87c073622bd61e38fe99c47365cda9c","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"1e33ca7f44be64beed2735bb76b86eb65ba8c05b","versionType":"git","status":"affected"},{"version":"553c942f8b2cbc7394b4d4fa2f848b23a8f07451","lessThan":"6395789e4739aa5177bbec0fa0f07ccc38d249b0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/vc4/vc4_irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb5656ae063f2711f56438cf2f1f5b613aea5f12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74455","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.120","lastModified":"2026-08-19T17:21:02.253","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: validate uCAN receive record lengths\n\npcan_usb_fd_decode_buf() walks uCAN records packed in one USB\nreceive buffer.\n\nRequire each record to contain the fixed header for its type, and verify\nCAN payload bytes before copying them into the skb."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/can/usb/peak_usb/pcan_usb_fd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"276d989cd2dd88e2b7ab2c96fd10c86836b12781","versionType":"git","status":"affected"},{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"bf9d787b7e1ef59be19b35abca08194772deb97e","versionType":"git","status":"affected"},{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"89c92a8052698dbbd3652a77c04d02bbd74a3275","versionType":"git","status":"affected"},{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"6067c878e38d02a3d5c43497347e143f85c9064a","versionType":"git","status":"affected"},{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"2c8f08f3641a074da40acf05baa5a18ae2739260","versionType":"git","status":"affected"},{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"2427ef427bdd78d862c7c76597bfd9eda88b81f1","versionType":"git","status":"affected"},{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"d9c115948c3dd5fcc2d0245cec5eb76c098503c8","versionType":"git","status":"affected"},{"version":"0a25e1f4f18566b750ebd3ae995af64e23111e63","lessThan":"93fcab2c6968446316bbb49548848df604d6346f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/can/usb/peak_usb/pcan_usb_fd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.0","status":"affected"},{"version":"0","lessThan":"4.0","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2427ef427bdd78d862c7c76597bfd9eda88b81f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/276d989cd2dd88e2b7ab2c96fd10c86836b12781","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c8f08f3641a074da40acf05baa5a18ae2739260","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6067c878e38d02a3d5c43497347e143f85c9064a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89c92a8052698dbbd3652a77c04d02bbd74a3275","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93fcab2c6968446316bbb49548848df604d6346f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf9d787b7e1ef59be19b35abca08194772deb97e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9c115948c3dd5fcc2d0245cec5eb76c098503c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74456","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.227","lastModified":"2026-08-19T17:21:02.377","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error\n\nIn peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()\nand the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also\nfrees the transfer buffer.\n\nIf usb_submit_urb() fails, the error path frees the buffer explicitly with\nkfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,\nusb_free_urb() -> urb_destroy() frees the same buffer a second time, a double\nfree of the transfer buffer.\n\n  BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0\n  Free of addr ffff8881069ccb80 by task trigger.sh/285\n\n  Call Trace:\n   kfree+0x113/0x3c0\n   usb_free_urb.part.0+0x91/0xb0\n\nDrop the redundant kfree(buf); usb_free_urb() already releases the transfer\nbuffer. This mirrors commit 03819abbeb11 (\"net: usb: lan78xx: Fix double free\nissue with interrupt buffer allocation\")."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/can/usb/peak_usb/pcan_usb_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"914c3b8fa175acf8476ad31cf04e308638e3578e","versionType":"git","status":"affected"},{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"5f2fa5840c34d3a558c57855781be75e03bef752","versionType":"git","status":"affected"},{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"b9088d581fff971a7eb1628f8dcc30df6cfef4dc","versionType":"git","status":"affected"},{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"525640b93d3e5f82f4ebea4730f4e0cf799522ba","versionType":"git","status":"affected"},{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"4bb3325075138dd5346b71589a959878b564dc0b","versionType":"git","status":"affected"},{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"92d0de80ca2223b9c7da78020155b6cb27824cc0","versionType":"git","status":"affected"},{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"dfb17bf04a764462000f11258a7c06aa92d1f261","versionType":"git","status":"affected"},{"version":"bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d","lessThan":"9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/can/usb/peak_usb/pcan_usb_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.4","status":"affected"},{"version":"0","lessThan":"3.4","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74457","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.333","lastModified":"2026-08-19T17:21:02.533","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: add bounds check for USB channel index\n\nThe channel control index ctrl_idx is derived from rx->len which comes\ndirectly from a device USB payload. The mask 0x0f allows values 0-15, but\nthe array size of usb_if->dev[] is only 2. Values 2-15 cause heap\nout-of-bounds read, eventually causing kernel panic in the IRQ context.\n\nAdd bounds checking for ctrl_idx before the array access in both\npcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/can/usb/peak_usb/pcan_usb_pro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"18b1a868a2cda66fb438007ba47ce5f2484db381","versionType":"git","status":"affected"},{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"0c9268457bd6e4058fe55b4db01b16661c2eacf5","versionType":"git","status":"affected"},{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"94fb6fe83ce152532b11b36730b30f3dc0c94217","versionType":"git","status":"affected"},{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f","versionType":"git","status":"affected"},{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"f97b7e5e1cdaae15cd95b3a360028c7929664969","versionType":"git","status":"affected"},{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"1acab790b7cecd4e144d1d18bdfe549e282f6b0b","versionType":"git","status":"affected"},{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"0149fdb50a30944827acf9600a2cc44de0325a7f","versionType":"git","status":"affected"},{"version":"d8a199355f8f8a0797c00d98788d7282c9ea38bd","lessThan":"39132f166ca8ce00ae60d8a9068e06a60943cc4b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/can/usb/peak_usb/pcan_usb_pro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.4","status":"affected"},{"version":"0","lessThan":"3.4","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0149fdb50a30944827acf9600a2cc44de0325a7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0c9268457bd6e4058fe55b4db01b16661c2eacf5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/18b1a868a2cda66fb438007ba47ce5f2484db381","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1acab790b7cecd4e144d1d18bdfe549e282f6b0b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/39132f166ca8ce00ae60d8a9068e06a60943cc4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94fb6fe83ce152532b11b36730b30f3dc0c94217","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f97b7e5e1cdaae15cd95b3a360028c7929664969","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74458","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.437","lastModified":"2026-08-19T17:21:02.653","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents\n\nThe wait and bulk receive paths walk variable-length commands from a\nUSB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be\ndispatched, and the wait path copies a matching command into a fixed\ncaller-owned struct kvaser_cmd using the device-provided length.\n\nReject nonzero commands that do not contain the fixed header or that\nextend beyond the current USB buffer item. In the wait path, also reject\na matching command that exceeds the destination before copying it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"c00ec53d7dec08134e97071850cc00ef000c5b77","versionType":"git","status":"affected"},{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"d9e91672526ffa279709b15490118aea1bdee714","versionType":"git","status":"affected"},{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"72f96c2942f11a0ae8663adcb3d9ee986e07d4fa","versionType":"git","status":"affected"},{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"695aea154bb2d453e6daada1510972fafd075285","versionType":"git","status":"affected"},{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"3d0897ec623e422695d70d80ae456f89476c5328","versionType":"git","status":"affected"},{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"185cb1fa38142a3cbf223dd8b3abb24217f330d3","versionType":"git","status":"affected"},{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"21f0465fd86d77794aaed8e05f833634f68d178d","versionType":"git","status":"affected"},{"version":"080f40a6fa28dab299da7a652e444b1e2d9231e7","lessThan":"0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74459","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.543","lastModified":"2026-08-19T17:21:02.803","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure\n\nes58x_read_bulk_callback() resubmits the RX URB after processing a received\npacket. If the resubmit succeeds, the URB remains anchored and will be\nhandled by the normal RX path or by teardown.\n\nHowever, if usb_submit_urb() fails, the callback unanchors the URB and then\nreturns directly. This skips the existing free_urb path, so the coherent\ntransfer buffer allocated with usb_alloc_coherent() is not released.\n\nReuse the existing free_urb path after a resubmit failure so that the RX\ncoherent buffer is freed before leaving the callback."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/can/usb/etas_es58x/es58x_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7a0171b4921ad443fee5ed4fcb9d99fa4776edac","lessThan":"c7ddf119544eea2d8409e12471c3f9f36ca02e3f","versionType":"git","status":"affected"},{"version":"2185ea6e4ebcb61d1224dc7d187c59723cb5ad59","lessThan":"21da1a374769751546cc131e58a4d8bd968f57b2","versionType":"git","status":"affected"},{"version":"f6e90c113c92e83fc0963d5e60e16b0e8a268981","lessThan":"0ef136ba052101243ba117a1aca6f4a4c3a81142","versionType":"git","status":"affected"},{"version":"b878444519fa03a3edd287d1963cf79ef78be2f1","lessThan":"b85e5c310382803d27adf6fe6554d4208bc8951c","versionType":"git","status":"affected"},{"version":"18eee279e9b5bff0db1aca9475ae4bc12804f05c","lessThan":"c311f17c261fd375ddf5755f2ebe1f022c19c5b0","versionType":"git","status":"affected"},{"version":"5eaad4f768266f1f17e01232ffe2ef009f8129b7","lessThan":"19c6c8c6cd5dd14fab5fcd744584812a57cbb78d","versionType":"git","status":"affected"},{"version":"5eaad4f768266f1f17e01232ffe2ef009f8129b7","lessThan":"7a0cf2b2497c757c3cb1286eddf2986abb0d387b","versionType":"git","status":"affected"},{"version":"b8f9ca88253574638bcff38900a4c28d570b1919","versionType":"git","status":"affected"},{"version":"5.15.203","lessThan":"5.15.216","versionType":"semver","status":"affected"},{"version":"6.1.167","lessThan":"6.1.183","versionType":"semver","status":"affected"},{"version":"6.6.130","lessThan":"6.6.151","versionType":"semver","status":"affected"},{"version":"6.12.77","lessThan":"6.12.103","versionType":"semver","status":"affected"},{"version":"6.18.17","lessThan":"6.18.44","versionType":"semver","status":"affected"},{"version":"6.19.7","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/can/usb/etas_es58x/es58x_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ef136ba052101243ba117a1aca6f4a4c3a81142","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19c6c8c6cd5dd14fab5fcd744584812a57cbb78d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21da1a374769751546cc131e58a4d8bd968f57b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a0cf2b2497c757c3cb1286eddf2986abb0d387b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b85e5c310382803d27adf6fe6554d4208bc8951c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c311f17c261fd375ddf5755f2ebe1f022c19c5b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7ddf119544eea2d8409e12471c3f9f36ca02e3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74460","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.663","lastModified":"2026-08-19T17:21:02.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ems_usb: validate CPC message lengths\n\nems_usb_read_bulk_callback() walks CPC messages packed in one USB\nreceive buffer.\n\nCheck that each declared message fits in the URB payload. Also require the\ntype-specific payload to cover the fields used by the CAN, state, error and\noverrun handlers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/can/usb/ems_usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"702171adeed3607ee9603ec30ce081411e36ae42","lessThan":"bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6","versionType":"git","status":"affected"},{"version":"702171adeed3607ee9603ec30ce081411e36ae42","lessThan":"db5655287d78f00daf98888a520bb8da4d30126d","versionType":"git","status":"affected"},{"version":"702171adeed3607ee9603ec30ce081411e36ae42","lessThan":"ce8125566b1d0b0f16449407e014addf451804ea","versionType":"git","status":"affected"},{"version":"702171adeed3607ee9603ec30ce081411e36ae42","lessThan":"0b9090717c7e2184e2c427bbcc752f295116ac1d","versionType":"git","status":"affected"},{"version":"702171adeed3607ee9603ec30ce081411e36ae42","lessThan":"0b23144c59c126beb4a7761a85a194ae0fe668a5","versionType":"git","status":"affected"},{"version":"702171adeed3607ee9603ec30ce081411e36ae42","lessThan":"df3ac2a672a5284441f120d486acabdd6740fc2a","versionType":"git","status":"affected"},{"version":"702171adeed3607ee9603ec30ce081411e36ae42","lessThan":"02925f51377f2a42a6724f00549167499c9302e5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/can/usb/ems_usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/02925f51377f2a42a6724f00549167499c9302e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b23144c59c126beb4a7761a85a194ae0fe668a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b9090717c7e2184e2c427bbcc752f295116ac1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce8125566b1d0b0f16449407e014addf451804ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db5655287d78f00daf98888a520bb8da4d30126d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df3ac2a672a5284441f120d486acabdd6740fc2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74461","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.763","lastModified":"2026-08-19T17:21:03.083","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: Cancel hrtimer before clearing slave pointer\n\nIn i2c_imx_unreg_slave(), the slave pointer is set to NULL after\ndisabling interrupts.  However, a pending interrupt might already\nhave started the hrtimer (i2c_imx_slave_timeout) before the pointer\nwas cleared.  If the hrtimer fires after i2c_imx->slave is set to\nNULL, the timer callback i2c_imx_slave_finish_op() will call\ni2c_imx_slave_event() with a NULL slave pointer, which results in a\nuse-after-free / NULL pointer dereference.\n\nFix by canceling the hrtimer and waiting for it to complete after\ndisabling interrupts, before clearing the slave pointer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/busses/i2c-imx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f7414cd6923fd7f78e57086fc964ba2dc25db5c1","lessThan":"e3da77bdb4015051656bb472c295656bbea03b6f","versionType":"git","status":"affected"},{"version":"f7414cd6923fd7f78e57086fc964ba2dc25db5c1","lessThan":"470fe15fb3bb2eba6629be301ca7e991ee3cfb7e","versionType":"git","status":"affected"},{"version":"f7414cd6923fd7f78e57086fc964ba2dc25db5c1","lessThan":"a8a1f9ac3d763e721586f15479ef9140b216ddf3","versionType":"git","status":"affected"},{"version":"f7414cd6923fd7f78e57086fc964ba2dc25db5c1","lessThan":"753060f2b77ff2f386addbd3ecadb95b9f90cddd","versionType":"git","status":"affected"},{"version":"f7414cd6923fd7f78e57086fc964ba2dc25db5c1","lessThan":"affd62f5719a78135b7441aa49c8cab3c3b5e838","versionType":"git","status":"affected"},{"version":"f7414cd6923fd7f78e57086fc964ba2dc25db5c1","lessThan":"dab4762ee7f3fd0a01980d5407ba48d0261d3bff","versionType":"git","status":"affected"},{"version":"f7414cd6923fd7f78e57086fc964ba2dc25db5c1","lessThan":"6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/busses/i2c-imx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/470fe15fb3bb2eba6629be301ca7e991ee3cfb7e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ac7702b6cc2b94aaed9ef2d95bfbefcdc90061f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/753060f2b77ff2f386addbd3ecadb95b9f90cddd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8a1f9ac3d763e721586f15479ef9140b216ddf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/affd62f5719a78135b7441aa49c8cab3c3b5e838","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dab4762ee7f3fd0a01980d5407ba48d0261d3bff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3da77bdb4015051656bb472c295656bbea03b6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74462","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.863","lastModified":"2026-08-17T06:19:42.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: mark I2C adapter when hardware is powered down\n\nOn some i.MX platforms, certain I2C client drivers keep a periodic\nworkqueue which continues to trigger I2C transfers.\n\nDuring system suspend/resume, there exists a time window between:\n  - suspend_noirq and the system entering suspend\n  - the system starting to resume and resume_noirq\n\nIn this window, the I2C controller resources such as clock and pinctrl\nmay already be disabled or not yet restored.\n\nIf a workqueue triggers an I2C transfer in this period, the driver\nattempts to access I2C registers while the hardware resources are\nunavailable, which may lead to system hang.\n\nMark the I2C adapter as suspended during noirq suspend and block new\ntransfers until resume, ensuring that I2C transfers are only issued\nwhen hardware resources are available."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/busses/i2c-imx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"358025ac091e5a54f9819b33ee9c7cb07c55ee5d","lessThan":"7a5db225ab5a6b095f6c37197b3b114921d85541","versionType":"git","status":"affected"},{"version":"358025ac091e5a54f9819b33ee9c7cb07c55ee5d","lessThan":"ec8e15e3e5c7e8180b13399f5a5aff8415bf16c5","versionType":"git","status":"affected"},{"version":"358025ac091e5a54f9819b33ee9c7cb07c55ee5d","lessThan":"00d86dd5c2034e0e139e4806137b3b43e07ddd83","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/busses/i2c-imx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00d86dd5c2034e0e139e4806137b3b43e07ddd83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a5db225ab5a6b095f6c37197b3b114921d85541","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec8e15e3e5c7e8180b13399f5a5aff8415bf16c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74463","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:50.963","lastModified":"2026-08-19T17:21:03.237","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock\n\nFix a severe AB/BA deadlock between the Common Clock Framework (CCF)\nand the I2C adapter lock, which triggers when an I2C-controlled clock\ngenerator client (like the Si5351) is registered or modified under the CCF.\n\nDuring an i2c client clock (generator) frequency change, the CCF acquires its global\n'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's\nchip registers, stalling for the adapter's I2C bus lock.\n\nConcurrently, an independent, parallel transfer on the same bus (e.g., a GPIO\nexpander handling LEDs) can hold the I2C adapter lock. Inside this parallel\ntransfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host\ncontroller's input clock to calculate bus timings. This call attempts to acquire\nthe blocked CCF 'prepare_lock', creating a circular dependency that freezes\nthe system.\n\nThe jz4780 host controller clock itself is static and never changes at runtime.\n\nHowever, calling clk_get_rate() inside the active transfer path introduces\nan unnecessary dependency on the CCF internal locks.\n\nEliminate this synchronous clk_get_rate() call from the active transfer\npath by caching the static host peripheral clock rate once - inside the private\njz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed()\nto use this cached value, safely decoupling active I2C transactions from the\nCCF internal locks without any risk of stale timings.\n\nAssisted-by web based Google AI (pinpointing the bug and writing the message)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/busses/i2c-jz4780.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"cc111696ef420f6bb552b2526530067977f0b406","versionType":"git","status":"affected"},{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"f96a719d9f8a797105ec5cacf568ab128e33391f","versionType":"git","status":"affected"},{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"deffad5bb4f8b4f09e46252f24754ddc9960b244","versionType":"git","status":"affected"},{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"14429dc1c756c35e106f01ff09cadccb82f5531d","versionType":"git","status":"affected"},{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"b6cb47e186abba85a3b08aa3023067ab82577286","versionType":"git","status":"affected"},{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"19b783335d62e7a2367436a6e1f1b37da1878360","versionType":"git","status":"affected"},{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"aa1944b52d6492c48bdd17046578aa0d953546e6","versionType":"git","status":"affected"},{"version":"ba92222ed63a12d09120df9b92f56cc990abac19","lessThan":"d99607c888f26e8a4e9fe9772860cef4aff86bb4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/busses/i2c-jz4780.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14429dc1c756c35e106f01ff09cadccb82f5531d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19b783335d62e7a2367436a6e1f1b37da1878360","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa1944b52d6492c48bdd17046578aa0d953546e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6cb47e186abba85a3b08aa3023067ab82577286","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc111696ef420f6bb552b2526530067977f0b406","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d99607c888f26e8a4e9fe9772860cef4aff86bb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deffad5bb4f8b4f09e46252f24754ddc9960b244","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f96a719d9f8a797105ec5cacf568ab128e33391f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74464","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.077","lastModified":"2026-08-19T17:21:03.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix skb leak on flow key update failure during ct\n\novs_ct_execute() always steals or frees the skb on failure while\novs_flow_key_update() does not.  So, if it fails and we return right\naway, the skb ends up leaked.\n\nFix that by breaking instead and letting the common error handling\ncode at the bottom of the loop to free the skb properly.\n\nThis is a very unlikely scenario as it requires the packet to become\nunparseable by applying a set of actions on a previously parseable skb,\nbut should be fixed nevertheless.\n\nReported by Sashiko."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/openvswitch/actions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"b77126b2915900f69f9fcf5d624a77c8e6d50c31","versionType":"git","status":"affected"},{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"6cc523eaee72c4e91894136cff64946ae9de2cda","versionType":"git","status":"affected"},{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"22e0ca88090d89c128078062186b03bb5fdc4f98","versionType":"git","status":"affected"},{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"736e972f3f8a304158345223ac6e816166a467ce","versionType":"git","status":"affected"},{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"e84dfaac50aab45ad8c670da43e3aa1f97bd2a41","versionType":"git","status":"affected"},{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"e0ba8eaef2a0d02a7a485e6a7157e47272b65cea","versionType":"git","status":"affected"},{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"393f3c72600ab6721d732a0ab245bc896c5b28fc","versionType":"git","status":"affected"},{"version":"ec0d043d05e6e3c0c2fac5de922c800c027c6386","lessThan":"bc62e843bc48f933da765ce47079fd992e535794","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/openvswitch/actions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/22e0ca88090d89c128078062186b03bb5fdc4f98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/393f3c72600ab6721d732a0ab245bc896c5b28fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cc523eaee72c4e91894136cff64946ae9de2cda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/736e972f3f8a304158345223ac6e816166a467ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b77126b2915900f69f9fcf5d624a77c8e6d50c31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc62e843bc48f933da765ce47079fd992e535794","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0ba8eaef2a0d02a7a485e6a7157e47272b65cea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e84dfaac50aab45ad8c670da43e3aa1f97bd2a41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74465","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.190","lastModified":"2026-08-19T17:21:03.497","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix potential UAF on meter attach failure\n\nWhile attaching a newly created meter attach_meter() function makes\nthe new meter visible to other CPUs but can still fail afterwards.\nOn failure, it detaches the meter back and returns an error.\n\nHowever, this is an unexpected behavior for the ovs_meter_cmd_set()\nthat uses a plain kfree(meter) on attach failure without waiting for\nRCU readers to stop using it, assuming it was never visible.\n\nThis is never a problem for ovs-vswitchd as it always creates meters\nbefore creating any flows that use them.  But the UAF can be triggered\nwith a custom application using uAPI:\n\n BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653)\n Read of size 8 at addr ffff88810d152650 by task meter/2508\n\n Call Trace:\n  ovs_meter_execute (net/openvswitch/meter.c:653)\n  do_execute_actions (net/openvswitch/actions.c:1407)\n  ovs_execute_actions (net/openvswitch/actions.c:1584)\n  ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)\n  ...\n  netlink_sendmsg (af_netlink.c:1900)\n\n Allocated by task 2519:\n  __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n  ovs_meter_cmd_set (net/openvswitch/meter.c:422)\n  ...\n  netlink_sendmsg (af_netlink.c:1900)\n\n Freed by task 2519:\n  kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)\n  ovs_meter_cmd_set (net/openvswitch/meter.c:479)\n  ...\n  netlink_sendmsg (af_netlink.c:1900)\n\nFix that by making sure attach_meter() doesn't make the meter visible\nuntil all the checks are done and the function can't fail anymore.\n\nThis also makes sure the \"hash\" value is calculated after the potential\nre-sizing of the table.\n\nReported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/openvswitch/meter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"496f3013c6ff759249abcfb2da2361c1a3e2e66d","versionType":"git","status":"affected"},{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"ddc0ef4217cc697c6ba1a295cc1ea42423ec68ac","versionType":"git","status":"affected"},{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"b0de3b58dac3b02b528f72ee0397728aed11f993","versionType":"git","status":"affected"},{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"0310d1fa7f9debd0d89629e9f14c7975a47eaa9a","versionType":"git","status":"affected"},{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3","versionType":"git","status":"affected"},{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"90623c9499627803ef3f04fa25a3199402d4fb95","versionType":"git","status":"affected"},{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61","versionType":"git","status":"affected"},{"version":"c7c4c44c9a95d87e50ced38f7480e779cb472174","lessThan":"a58a2b0ce354df531ebc71fc870058c2feb59f6b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/openvswitch/meter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0310d1fa7f9debd0d89629e9f14c7975a47eaa9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/496f3013c6ff759249abcfb2da2361c1a3e2e66d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90623c9499627803ef3f04fa25a3199402d4fb95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a58a2b0ce354df531ebc71fc870058c2feb59f6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0de3b58dac3b02b528f72ee0397728aed11f993","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddc0ef4217cc697c6ba1a295cc1ea42423ec68ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74466","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.307","lastModified":"2026-08-17T06:19:42.543","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Close speculative mem read possibility\n\nThe domain value is extracted from a given CCA or EP11 ioctl struct\nwhen a CPRB is about to be sent. Thus this is a user controlled value.\nUnder some special conditions (custom device node used, administrative\nload) this value is used as an array index after bounds checking, but\nwithout speculation barrier.\n\nAdd the missing array_index_nospec() call to prevent speculative\nexecution where this domain value is used."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/s390/crypto/zcrypt_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cfd68b33094e1a92249850ff3c3c92ae9112a541","lessThan":"82b62eda68abfb7a33ac40f24b8c4128c2891148","versionType":"git","status":"affected"},{"version":"cfd68b33094e1a92249850ff3c3c92ae9112a541","lessThan":"e935cd525af4c6ed2e2c6404aa27ca19c7f39ddb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/s390/crypto/zcrypt_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/82b62eda68abfb7a33ac40f24b8c4128c2891148","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e935cd525af4c6ed2e2c6404aa27ca19c7f39ddb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74467","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.403","lastModified":"2026-08-19T17:21:03.663","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/qeth: Check CAP_NET_ADMIN for private ioctls\n\nGate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL,\nSIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN\ncapable check to ensure unprivileged users cannot invoke them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/s390/net/qeth_core_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"18787eeebd7129ecf4960876d24f349682207783","lessThan":"8fb69547924bbb3d7c900a0d7d137a7234db3f5f","versionType":"git","status":"affected"},{"version":"18787eeebd7129ecf4960876d24f349682207783","lessThan":"3ea5210db058347481c93849786982f874f7be2d","versionType":"git","status":"affected"},{"version":"18787eeebd7129ecf4960876d24f349682207783","lessThan":"4e48168825818bf4a13c743582227d15f1d30d04","versionType":"git","status":"affected"},{"version":"18787eeebd7129ecf4960876d24f349682207783","lessThan":"b40c74262f7e1e601221cebccdbdb2b392ff9976","versionType":"git","status":"affected"},{"version":"18787eeebd7129ecf4960876d24f349682207783","lessThan":"bd63c7879eaa87f1958f7ee027813356fcd9ff11","versionType":"git","status":"affected"},{"version":"18787eeebd7129ecf4960876d24f349682207783","lessThan":"93a0a846ec59a88e0c402878a15357a5ce430eb4","versionType":"git","status":"affected"},{"version":"18787eeebd7129ecf4960876d24f349682207783","lessThan":"d211028bac1bd0fff0026bfa2a8328e5b78cd0e6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/s390/net/qeth_core_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3ea5210db058347481c93849786982f874f7be2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e48168825818bf4a13c743582227d15f1d30d04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fb69547924bbb3d7c900a0d7d137a7234db3f5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93a0a846ec59a88e0c402878a15357a5ce430eb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b40c74262f7e1e601221cebccdbdb2b392ff9976","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd63c7879eaa87f1958f7ee027813356fcd9ff11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d211028bac1bd0fff0026bfa2a8328e5b78cd0e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74468","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.500","lastModified":"2026-08-19T17:21:03.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pch: use raw_spinlock_t for the register lock\n\npch_irq_type() is registered as the irq_chip .irq_set_type callback and\ntakes chip->spinlock with spin_lock_irqsave().  This callback is reached\nfrom __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while\nthe caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.\nThat context is not sleepable, but on PREEMPT_RT a regular spinlock_t is\nan rtmutex-backed sleeping lock, so acquiring it there is invalid.\n\nThis was confirmed on a PREEMPT_RT kernel with lockdep\n(PROVE_RAW_LOCK_NESTING and DEBUG_ATOMIC_SLEEP).  A grounded PoC mirrored\npch_irq_type()'s locking and drove it through the real genirq carrier\nirq_set_irq_type() -> __irq_set_trigger() -> chip->irq_set_type(), i.e.\nthe same __irq_set_trigger() edge that __setup_irq() takes for a\nrequested IRQ.  With the original spin_lock_irqsave() edge lockdep\nreported an invalid wait context, immediately followed by:\n\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 95, name: insmod\n  hardirqs last disabled at (3784): _raw_spin_lock_irqsave+0x4f/0x60\n   rt_spin_lock+0x3a/0x1c0\n   repro_irq_set_type+0x64/0xa0 [pch_repro]\n   __irq_set_trigger+0x69/0x140\n   irq_set_irq_type+0x78/0xd0\n\nSwitching the mirrored lock to raw_spinlock_t made both splats go away.\n\nConvert the register lock to raw_spinlock_t.  The same lock also\nserializes the GPIO direction/value callbacks and the suspend/resume\nregister save/restore, but all of those critical sections only perform\nMMIO register accesses (ioread32()/iowrite32()) and\nirq_set_handler_locked(); none of them contain sleepable operations.\nKeeping this register lock non-sleeping is therefore appropriate for the\nirqchip callbacks and does not change the GPIO-side locking contract.\n\nThis is the same class of issue and fix as recently addressed for other\nGPIO controllers, e.g. commit 286533cb14a3 (\"gpio: sch: use raw_spinlock_t\nin the irq startup path\") and commit 90f0109019e6 (\"gpio: eic-sprd: use\nraw_spinlock_t in the irq startup path\")."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpio/gpio-pch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"efc76a3f5353dd33a2e2ad48200cd4a18de30a0d","versionType":"git","status":"affected"},{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"935e6872db7faecfbe1a10b3f5d97a62fdff5ec9","versionType":"git","status":"affected"},{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"98f292cb6d01487d17988d9fd4e19c13e7adb156","versionType":"git","status":"affected"},{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"16da33cb36e663b6967112185e11d00ce8ff957c","versionType":"git","status":"affected"},{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"ff050589a21967883bb55f6dba42568f8367ad4a","versionType":"git","status":"affected"},{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"466ab0c41d5f54f71cee60619d07c4abd0ffd2cd","versionType":"git","status":"affected"},{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"c0a4ec89fc26e4b679b04f1002c503cb2529acdc","versionType":"git","status":"affected"},{"version":"38eb18a6f92da886fc1af509d25e8f7a49e23d9a","lessThan":"a02b8950d619123da64f69b70fe1dadef217dfe4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpio/gpio-pch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/16da33cb36e663b6967112185e11d00ce8ff957c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/466ab0c41d5f54f71cee60619d07c4abd0ffd2cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/935e6872db7faecfbe1a10b3f5d97a62fdff5ec9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98f292cb6d01487d17988d9fd4e19c13e7adb156","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a02b8950d619123da64f69b70fe1dadef217dfe4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0a4ec89fc26e4b679b04f1002c503cb2529acdc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/efc76a3f5353dd33a2e2ad48200cd4a18de30a0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff050589a21967883bb55f6dba42568f8367ad4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74469","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.623","lastModified":"2026-08-19T17:21:03.977","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sctp/associola.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"b453e00da1211e997b82743d28af7714c59c05c8","versionType":"git","status":"affected"},{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"dfea32dd76f390e3155177b0038cc47b01386198","versionType":"git","status":"affected"},{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"80f48523a0fe42db2e7375dff4e38a25c117090a","versionType":"git","status":"affected"},{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"546221b86ceeba0d8fec92d46a0604bb7b62be07","versionType":"git","status":"affected"},{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"09e722030e8148ba4ed1e42c6b2ea57bda9f9895","versionType":"git","status":"affected"},{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0","versionType":"git","status":"affected"},{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75","versionType":"git","status":"affected"},{"version":"8f840e47f190cbe61a96945c13e9551048d42cef","lessThan":"bd0e9289e2642f6a5c54faad304ce0f41e926d22","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sctp/associola.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74470","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.727","lastModified":"2026-08-23T13:16:43.967","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the\ndescriptor count:\n\n\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -\n\t\t\t RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);\n\nFor alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which\npasses the !arr check, and desc = arr + 64 is then dereferenced in the\nloop -> out-of-bounds write / panic.\n\nClamp rep_max_zones to devip->nr_zones. The loop already stops at\nsdebug_capacity (after nr_zones zones), so a report can never hold more\nthan nr_zones descriptors; the clamp does not change the report, it only\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device\nproperty that can never reach 0x100000000."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/scsi_debug.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ebacb44cb2042b90951140eda806bedad23ef554","lessThan":"7b615fc139e35c81077046df44725c532f7e2404","versionType":"git","status":"affected"},{"version":"7db0e0c8190a086ef92ce5bb960836cde49540aa","lessThan":"5d3e1d006bbb543259f9e31824caadbfff6a5465","versionType":"git","status":"affected"},{"version":"7db0e0c8190a086ef92ce5bb960836cde49540aa","lessThan":"49e5b25a0b74dbac595f122e5608fdce2918cc4e","versionType":"git","status":"affected"},{"version":"7db0e0c8190a086ef92ce5bb960836cde49540aa","lessThan":"495058429ca55ab7fcc21977b63b92907ad68066","versionType":"git","status":"affected"},{"version":"7db0e0c8190a086ef92ce5bb960836cde49540aa","lessThan":"2047ed09bf13453b7d6f9431b112ec07984dd69b","versionType":"git","status":"affected"},{"version":"7db0e0c8190a086ef92ce5bb960836cde49540aa","lessThan":"d6e6da6bc3b53231fac77ffab428da8173ee729c","versionType":"git","status":"affected"},{"version":"7db0e0c8190a086ef92ce5bb960836cde49540aa","lessThan":"93dde0bf2f39a0f9f57fd610aa3201ce5b753433","versionType":"git","status":"affected"},{"version":"c4d2d7c935a4ad20e8e726ca10499cefe4537103","versionType":"git","status":"affected"},{"version":"5.15.8","lessThan":"5.15.217","versionType":"semver","status":"affected"},{"version":"5.10.85","lessThan":"5.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/scsi_debug.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74471","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.847","lastModified":"2026-08-19T17:21:04.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check return value of __register_event() in trace_module_add_events()\n\ntrace_module_add_events() ignores the return value of __register_event()\nand unconditionally calls __add_event_to_tracers() for each event.\n\nIf __register_event() fails (for example, if event_init() fails), the\ntrace_event_call is not added to ftrace_events list, but\n__add_event_to_tracers() still creates a trace_event_file pointing to it.\nIf module loading subsequently fails and module memory is freed, tracing\nstate retains a stale trace_event_call pointer in trace_event_file,\nleading to a use-after-free when tracefs or tracing subsystem operations\nare later executed.\n\nFix this by checking the return value of __register_event() and only\ncalling __add_event_to_tracers() if event registration succeeded."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"3bf965a2827c44f03294107703e7ba53fbd0a69a","versionType":"git","status":"affected"},{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"9d6d79744f01eacaf3d5522f4fcd59939581abfd","versionType":"git","status":"affected"},{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"54b7a358f6399c1242d2fb7f4f96085af34baa5e","versionType":"git","status":"affected"},{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5","versionType":"git","status":"affected"},{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"22f954f7a8afe975e85517aff41b35defe05144b","versionType":"git","status":"affected"},{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca","versionType":"git","status":"affected"},{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"000765dcdc3edf128990762790543adc4b868f6c","versionType":"git","status":"affected"},{"version":"ae63b31e4d0e2ec09c569306ea46f664508ef717","lessThan":"ac8719969e6c3c54e939834df812bc41f25453cf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bf965a2827c44f03294107703e7ba53fbd0a69a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54b7a358f6399c1242d2fb7f4f96085af34baa5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d6d79744f01eacaf3d5522f4fcd59939581abfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74472","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:51.953","lastModified":"2026-08-19T17:21:04.490","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()\n\nublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into\nub->dev_info and then fixes up the fields the driver owns, but misses\n->state and ->ublksrv_pid.\n\nA device added with ->state = UBLK_S_DEV_LIVE passes the\n\"->state != UBLK_S_DEV_DEAD\" test that ublk_stop_dev_unlocked() uses as its\nproxy for \"a disk is attached\", while ->ub_disk is still NULL, so DEL_DEV\nright after ADD_DEV oopses in del_gendisk().  UBLK_S_DEV_QUIESCED plus\nUBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev().  A\npoisoned ->state also gets START_USER_RECOVERY and the char device\nread/write path onto a device that was never started, and wedges START_DEV\nat -EEXIST.  A poisoned ->ublksrv_pid just makes GET_DEV_INFO report an\nunrelated task as the ublk server.\n\nReset both after the memcpy(), as ublk_detach_disk() does.  Userspace only\never reads these back, so correcting them silently breaks nothing.\n\nADD_DEV has copied ->state in unsanitized since ublk was merged, but back\nthen it was harmless: the gendisk was allocated during ADD_DEV, and both\nteardown and the START_DEV -EEXIST check keyed off disk_live() rather than\n->state.  The oops became reachable once the disk allocation moved to\nSTART_DEV and those checks switched to ->state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6d9e6dfdf3b207701471f364121c67eefb000682","lessThan":"787c944502e7e63d20a9201bada77e0dd924f458","versionType":"git","status":"affected"},{"version":"6d9e6dfdf3b207701471f364121c67eefb000682","lessThan":"ee41b00858ca65b4428e99efe39a4277c1f043d2","versionType":"git","status":"affected"},{"version":"6d9e6dfdf3b207701471f364121c67eefb000682","lessThan":"b67ce16b26ad0f14cfd6071013840aa95f823bea","versionType":"git","status":"affected"},{"version":"6d9e6dfdf3b207701471f364121c67eefb000682","lessThan":"205feb72e5beb3140e4e1403b6cff30cf739bab9","versionType":"git","status":"affected"},{"version":"6d9e6dfdf3b207701471f364121c67eefb000682","lessThan":"127033b79383a3e78361d7e971588aa8849f5124","versionType":"git","status":"affected"},{"version":"6d9e6dfdf3b207701471f364121c67eefb000682","lessThan":"e65848e4ce352bac9e3465099354c8b8f845391f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/block/ublk_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/127033b79383a3e78361d7e971588aa8849f5124","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/205feb72e5beb3140e4e1403b6cff30cf739bab9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/787c944502e7e63d20a9201bada77e0dd924f458","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b67ce16b26ad0f14cfd6071013840aa95f823bea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e65848e4ce352bac9e3465099354c8b8f845391f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee41b00858ca65b4428e99efe39a4277c1f043d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74473","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.060","lastModified":"2026-08-19T17:21:04.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb->data.\n\nHowever, in vxlan_xmit(), skb->data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"c419af4924c1593500a40519730ed98575d04a3e","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"6bd0a3a1b5744166946f0c551a6665c3b46b05e4","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"214ba43faf106cb06cd3dd30999c5c809c868b53","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"42887be7c4cf283cce02cd0fb6411221167c8b6c","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"aa0d31376d574ac858a40078431a77127bf04ee4","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"ee799977d7941dbfb11049e17edd9eaf4f8820f7","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"4f3f96e771a20263635bb5e1307c112d613b4bbd","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74474","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.177","lastModified":"2026-08-23T13:16:44.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() for transmit path header pulls\n\nIn vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was\nbeing called to verify the availability of network layer headers (ARP, IPv6/ND,\nIP/IPv6 MDB keys).\n\nHowever, during transmit skb->data points to the MAC header, so skb_network_offset(skb)\nis ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data\nrather than skb_network_offset(skb) + len, which can leave part of the network header\nin non-linear frags.\n\nReplace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly\naccount for the MAC header offset."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_core.c","drivers/net/vxlan/vxlan_mdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"6146901881f09ef063eb34ad389f63231f8486f5","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"94dee751aad627b3645d424b5d0c736d394573e9","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"7076a34b6e33315dc160b4612bfea1c597495585","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"b9553558b48db54ac9273e6b98d7263ef5c1a329","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_core.c","drivers/net/vxlan/vxlan_mdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6146901881f09ef063eb34ad389f63231f8486f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74475","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.293","lastModified":"2026-08-19T17:21:04.787","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n->ha can be updated asynchronously by the\nneighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without\nholding the seqlock loop can lead to torn reads or reading a partially updated\nMAC address.\n\nUse neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under\nread_seqbegin()/read_seqretry() lock protection before using it.\n\nNote that arp_reduce() and neigh_reduce() seem to have the same issue\nleft for future patches."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"32a9590a8d30426e3db63e6b20893e47e02576c0","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"d0993fc053f29e15cc7c9fe2029df3882a2ab5ab","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"87210054bad82bbae6f483a742dc45722fb47a6b","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"ec341bb76d77b4c2948764375ee6bfeef4bb41c3","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"ff89415d34c3ab9f5312316423122e664ed3524f","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"05f2987f73daa05333fd713d05546142f9f7c5f0","versionType":"git","status":"affected"},{"version":"e4f67addf158f98f8197e08974966b18480dc751","lessThan":"8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/05f2987f73daa05333fd713d05546142f9f7c5f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32a9590a8d30426e3db63e6b20893e47e02576c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87210054bad82bbae6f483a742dc45722fb47a6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0993fc053f29e15cc7c9fe2029df3882a2ab5ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec341bb76d77b4c2948764375ee6bfeef4bb41c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff89415d34c3ab9f5312316423122e664ed3524f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74476","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.397","lastModified":"2026-08-23T13:16:44.250","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/veth.c","net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","lessThan":"0be3632597b8349d43a7dc4244b492dc62a05998","versionType":"git","status":"affected"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","lessThan":"04958dba44dc795dc79ce2fcbc117821bbbd6542","versionType":"git","status":"affected"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","lessThan":"5c1c15c540fc45820ce3033c319151ec891bc10a","versionType":"git","status":"affected"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","lessThan":"b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb","versionType":"git","status":"affected"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","lessThan":"f9c1fff857e93be709c8b52ed1a643f37bd82c66","versionType":"git","status":"affected"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","lessThan":"d0d6415963040c401e7a7e4e482a698ba52448cb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/veth.c","net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74477","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.497","lastModified":"2026-08-17T06:19:43.777","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes: Fix NULL pointer dereference in hprobe_expire()\n\nForking a task that has a pending uretprobe can oops the kernel with a\nNULL pointer dereference in the clone() path:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  Oops: 0002 [#1] SMP NOPTI\n  RIP: 0010:hprobe_expire\n  CR2: 0000000000000018\n  Call Trace:\n   uprobe_copy_process\n   copy_process\n   kernel_clone\n   __x64_sys_clone\n   do_syscall_64\n   entry_SYSCALL_64_after_hwframe\n\nThis was found on real hosts on Meta fleet.\n\nI've got the impression that this is what is happening:\n\n  CPU 1                          CPU 2 (traced task)\n  -----                          -------------------\n                                 hit uprobe, prepare_uretprobe():\n                                   hprobe LEASED, refcount >= 1\n  uprobe_unregister()\n    put_uprobe(): refcount -> 0\n                                 fork() -> dup_utask()\n                                   hprobe_expire(hprobe, true)\n                                     try_get_uprobe() -> NULL\n                                     get_uprobe(NULL)   <-- Oops\n\nOnly take the extra reference when the uprobe is non-NULL; a NULL means\nit is gone and is the correct value to return."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/events/uprobes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dd1a7567784e2b1f80258be04f57bcfa82c997eb","lessThan":"3bd35a5e272a1b7a3fb43acad9bdc599281b13fa","versionType":"git","status":"affected"},{"version":"dd1a7567784e2b1f80258be04f57bcfa82c997eb","lessThan":"06c275a6c0a953ef1d763d11a6891fcc69ae2ac0","versionType":"git","status":"affected"},{"version":"dd1a7567784e2b1f80258be04f57bcfa82c997eb","lessThan":"cc679d7a6303e84d769f2afcde1fc51c51f127cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/events/uprobes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06c275a6c0a953ef1d763d11a6891fcc69ae2ac0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bd35a5e272a1b7a3fb43acad9bdc599281b13fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc679d7a6303e84d769f2afcde1fc51c51f127cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74478","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.600","lastModified":"2026-08-19T17:21:04.947","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\num: vector: fix use-after-free in vector_mmsg_rx()\n\nWhen vector_mmsg_rx() discards a packet whose overlay header fails\nverify_header(), it frees the skb and continues the loop:\n\n\tif (header_check < 0) {\n\t\tdev_kfree_skb_irq(skb);\n\t\tvp->estats.rx_encaps_errors++;\n\t\tcontinue;\n\t}\n\nThe normal and short-packet paths fall through to the bottom of the\nloop body, which clears the consumed slot and advances the cursors:\n\n\t(*skbuff_vector) = NULL;\n\tmmsg_vector++;\n\tskbuff_vector++;\n\nThe verify_header() < 0 path skips that via continue, so the freed skb\nis left in skbuff_vector[] and the cursors do not advance. The next\niteration reads the same slot, gets the freed skb, and frees it again,\nproducing a refcount underflow / use-after-free in the RX path.\n\nDiscard the slot the same way the other paths do before continuing.\n\nOnly transports whose verify_header() can return negative are affected:\nGRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not),\nso any peer on such a transport can trigger it without authentication."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/um/drivers/vector_kern.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"967c779c9853d2a1cc9cd8e61d300250c348f3d9","versionType":"git","status":"affected"},{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"a7bc015bb798c525e7a82dd14225c6aeb994274b","versionType":"git","status":"affected"},{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"7dc9781e320d664c9bdd50003c9acfddf363d1e1","versionType":"git","status":"affected"},{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"4b9601595e8b6b5d18878cac0aeabc687d241111","versionType":"git","status":"affected"},{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"67d58ab4f2ccf7145f3da07e025735a09c79de1b","versionType":"git","status":"affected"},{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"180ff4c81faf01ec4e06082c9daa7c40518ead89","versionType":"git","status":"affected"},{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"804b681002ead233abf49a3efd681f5468a835f9","versionType":"git","status":"affected"},{"version":"49da7e64f33e80edffb1a9eeb230fa4c3f42dffb","lessThan":"af421e9aed3920c7ac88c24daa48606c7112feca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/um/drivers/vector_kern.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/180ff4c81faf01ec4e06082c9daa7c40518ead89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b9601595e8b6b5d18878cac0aeabc687d241111","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67d58ab4f2ccf7145f3da07e025735a09c79de1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7dc9781e320d664c9bdd50003c9acfddf363d1e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/804b681002ead233abf49a3efd681f5468a835f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/967c779c9853d2a1cc9cd8e61d300250c348f3d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7bc015bb798c525e7a82dd14225c6aeb994274b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af421e9aed3920c7ac88c24daa48606c7112feca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74479","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.713","lastModified":"2026-08-23T13:16:44.380","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc entry use-after-free\n\npktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\n\nThis allows the following interleaving:\n\n  CPU 0 (NETDEV_CHANGENAME)       CPU 1 (kpktgend)\n  if_lock(t)\n  proc_remove(pkt_dev->entry)\n                                  proc_remove(pkt_dev->entry)\n  pkt_dev->entry = proc_create_data(...)\n  if_unlock(t)\n\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\n\n  BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\n  Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\n  Call Trace:\n   proc_remove+0x78/0x80\n   pktgen_remove_device.isra.0+0x11c/0x4c0\n   pktgen_thread_worker+0x1214/0x6bc0\n   kthread+0x2c6/0x3b0\n  Allocated by task 95:\n   __proc_create+0x204/0x790\n   proc_create_data+0x72/0xe0\n   pktgen_thread_write+0xd61/0x1510\n  Freed by task 28:\n   kmem_cache_free+0xcb/0x3d0\n   proc_free_inode+0x5b/0x80\n   rcu_core+0x50a/0x1850\n  The buggy address belongs to the object at ffff8881478fea00\n   which belongs to the cache proc_dir_entry of size 192\n\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/pktgen.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"82ed3db9269cb61e3c15bad2f6e221efce90e1e0","versionType":"git","status":"affected"},{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4","versionType":"git","status":"affected"},{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4","versionType":"git","status":"affected"},{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"577443530cb592d5782a1f79847411a9363a65c8","versionType":"git","status":"affected"},{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"f85a58340b91f225de3299dfa782c6414098077c","versionType":"git","status":"affected"},{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"4ef801b838d85c0ea5852c50667f7344ce3b6cd0","versionType":"git","status":"affected"},{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"b006a5404470bd3eb2aa0425fc447183032047ef","versionType":"git","status":"affected"},{"version":"39df232f1a9ba48d41c68ee7d4046756e709cf91","lessThan":"817ff6efdb7f484ea547218e11e17d8e43daa3b4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/pktgen.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","versionType":"semver","status":"unaffected"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74480","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.820","lastModified":"2026-08-19T17:21:05.127","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: stop fast-leave after deleting a port group\n\nbr_multicast_leave_group() iterates mp->ports with pp = &p->next in\nits fast-leave path. After br_multicast_del_pg() removes p,\ncontinuing the loop advances pp through the deleted entry.\n\nIf multicast-to-unicast was enabled, the bridge can hold multiple port\ngroups for the same port and group with different source MAC\naddresses. Once multicast-to-unicast is disabled,\nbr_port_group_equal() matches those entries by port only. A fast leave\ncan then delete one entry and continue from its stale next pointer,\nleaving mp->ports pointing at a deleted port group.\n\nFast leave only needs to remove one matching port group. Break after\nbr_multicast_del_pg() so the loop stops before dereferencing the\nremoved entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/br_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"d6c32e2e25a9a06ba021030e26b6d602a277eb72","versionType":"git","status":"affected"},{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"482bcb85139addb4e8ac8ed10baeda3e0aad4031","versionType":"git","status":"affected"},{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"1a109cc9890d017c41d77e6c82da739579c49f0b","versionType":"git","status":"affected"},{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"159ad90cb929c033308bb39a2c5f8fbf393b77aa","versionType":"git","status":"affected"},{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"4695430e8132420bf8de94da3eb36a6cf35fde6b","versionType":"git","status":"affected"},{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"0309ebbc570000ea0df11c06b69798e5860c5f6f","versionType":"git","status":"affected"},{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4","versionType":"git","status":"affected"},{"version":"6db6f0eae6052b70885562e1733896647ec1d807","lessThan":"a39789f211b8a4125f0c70e05b30cf715f4f187d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/br_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0309ebbc570000ea0df11c06b69798e5860c5f6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/159ad90cb929c033308bb39a2c5f8fbf393b77aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a109cc9890d017c41d77e6c82da739579c49f0b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4695430e8132420bf8de94da3eb36a6cf35fde6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/482bcb85139addb4e8ac8ed10baeda3e0aad4031","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c57056ca6aace2e9f94ae9298bf49ef6b0c95e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a39789f211b8a4125f0c70e05b30cf715f4f187d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6c32e2e25a9a06ba021030e26b6d602a277eb72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74481","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:52.930","lastModified":"2026-08-19T17:21:05.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_reporting: use system_freezable_wq to fix UAF during suspend\n\nDuring PM freeze (e.g.  S3 suspend or S4 hibernation), device drivers like\nvirtio_balloon reset their underlying virtio devices and delete their\nvirtqueues via vdev->config->del_vqs().\n\nHowever, page reporting work (page_reporting_process) was scheduled on the\nglobal system_wq.  Because system_wq lacks the WQ_FREEZABLE flag, the PM\nfreezer skips it, leaving page_reporting_process active during suspend.\n\nIf pages are freed into the buddy allocator while suspending (for example,\nwhen core MM invokes the balloon shrinker during S4 hibernation image\nsaving), page reporting triggers virtballoon_free_page_report() on deleted\nvirtqueues, resulting in a Use-After-Free / General Protection Fault:\n\n    [  196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI\n    [  196.825967] Workqueue: events page_reporting_process\n    [  196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring]\n    [  196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon]\n    [  196.946943] page_reporting_process+0x370/0x4f0\n\nFix this by switching page reporting work to system_freezable_wq.  This\nensures that the PM freezer pauses page_reporting_process before device\ndrivers destroy their reporting virtqueues.  Because the reporting worker\nis frozen, memory reclamation/freeing (e.g.  via shrinker execution) can\nsafely return pages to MM during freeze without triggering unfrozen\nreporting work on deleted virtqueues.\n\nThis aligns with the driver's existing design. The comment in\nvirtballoon_freeze() states:\n    /*\n     * The workqueue is already frozen by the PM core before this\n     * function is called.\n     */\n\nTesting:\nI have verified these fixes using Google’s virtualization infrastructure\nby running continuous suspend/resume iterations (40+ cycles) while\nchurning memory using stress-ng (`stress-ng --vm 4 --vm-bytes 60%\n--timeout 1`) to constantly create free pages for the buddy allocator.  We\nalso set the `page_reporting_order` parameter to 0 to make the page\nreporting worker highly sensitive, forcing it to pick up any 4K free\npages.  This confirmed that the UAF crashes are no longer reproducible."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/page_reporting.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"a4c60046052777ca1dcc83fe3ece2a5136b301f1","versionType":"git","status":"affected"},{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"b2c094e98f8bb823b3ae475f7169fe2091c40c6d","versionType":"git","status":"affected"},{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"992f270fd808338fbae1f498a5e325e7e2e20368","versionType":"git","status":"affected"},{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"f978048326570047e8216e81a67f9c71ef2bb1b1","versionType":"git","status":"affected"},{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"450f35f4d5a682a0796757e52295df58ddb63bc9","versionType":"git","status":"affected"},{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"b11907c905fa08eda925395f0724b7a409870f65","versionType":"git","status":"affected"},{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"faf439b5fa7b231120eac4f7a617e0bfd4f6f5c7","versionType":"git","status":"affected"},{"version":"36e66c554b5c6a9d17a229faca7a61693527b0bd","lessThan":"0b45f6927a14914ff685fe0e6f9d11232a1e03df","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/page_reporting.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0b45f6927a14914ff685fe0e6f9d11232a1e03df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/450f35f4d5a682a0796757e52295df58ddb63bc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/992f270fd808338fbae1f498a5e325e7e2e20368","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4c60046052777ca1dcc83fe3ece2a5136b301f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b11907c905fa08eda925395f0724b7a409870f65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2c094e98f8bb823b3ae475f7169fe2091c40c6d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f978048326570047e8216e81a67f9c71ef2bb1b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/faf439b5fa7b231120eac4f7a617e0bfd4f6f5c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74482","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.053","lastModified":"2026-08-19T17:21:05.477","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios\n\n__folio_split() keeps dereferencing the mapping after the split:\nshmem_uncharge(mapping->host) and remap_page() while the folios are still\nfrozen/locked, and i_mmap_unlock_read(mapping) at the very end, after the\nafter-split folios have been unlocked and freed.\n\nNothing holds an inode reference across that.  The split relies on @folio\n-- which the beyond-EOF drop loop never removes, as it starts at\nfolio_next(folio) -- staying locked and in the page cache to hold off\neviction.  But the unlock loop unlocks @folio before i_mmap_unlock_read()\nruns.  If the caller's @lock_at is a tail beyond EOF, as memory_failure()\npasses when splitting a poisoned tail of a shmem THP that reaches past\ni_size during truncation, it too is gone from the page cache; so once\n@folio is unlocked no locked, in-cache folio pins the inode, and a\nconcurrent final iput() can evict and RCU-free it before\ni_mmap_unlock_read() touches i_mmap_rwsem:\n\n  BUG: KASAN: slab-use-after-free in __up_read+0x634/0x790\n   i_mmap_unlock_read include/linux/fs.h:537 [inline]\n   __folio_split+0x732/0x1640 mm/huge_memory.c:4100\n   try_to_split_thp_page+0xab/0x390 mm/memory-failure.c:1675\n   memory_failure+0x1394/0x26e0 mm/memory-failure.c:2470\n\n  Freed by task 4601:\n   shmem_free_in_core_inode+0x54/0xb0 mm/shmem.c:5177\n   evict+0x57f/0xac0 fs/inode.c:870\n\nDo every mapping dereference while @folio still pins the inode: drop\ni_mmap_rwsem right after remap_page(), before the loop that unlocks and\nfrees the after-split folios, and clear @mapping so the exit path does not\nunlock it again.  shmem_uncharge() and remap_page() already run before\nthat point, so after this nothing past the unlock loop touches the inode\nor the mapping.\n\nThis is now a rule the split depends on, alongside keeping @folio frozen\nuntil the page cache is updated: no inode or mapping dereference once the\nafter-split folios start being unlocked."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/huge_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a","versionType":"git","status":"affected"},{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"f87c08060818ebb19bafed37c38244538da25097","versionType":"git","status":"affected"},{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"6f5c272d71845a669e4c8ee5c72b376e29a0e6e5","versionType":"git","status":"affected"},{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"be106f7855f03d3128ed0ce70ba74b484a90b473","versionType":"git","status":"affected"},{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"e3dd774dbfd0b5bc2dbd0995221751b1234f8205","versionType":"git","status":"affected"},{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"10065fb891651d9541e7a5a2db84c1e656ece4f9","versionType":"git","status":"affected"},{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"d640efe94d86d3be893d4c19220362546a637e90","versionType":"git","status":"affected"},{"version":"baa355fd331424526e742d41d9b90d5f9d10f716","lessThan":"e923bd21058ea02fd0dcd3549d151d143fd036e5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/huge_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/10065fb891651d9541e7a5a2db84c1e656ece4f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f5c272d71845a669e4c8ee5c72b376e29a0e6e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be106f7855f03d3128ed0ce70ba74b484a90b473","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d640efe94d86d3be893d4c19220362546a637e90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3dd774dbfd0b5bc2dbd0995221751b1234f8205","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e923bd21058ea02fd0dcd3549d151d143fd036e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f87c08060818ebb19bafed37c38244538da25097","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74483","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.163","lastModified":"2026-08-23T13:16:44.530","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: don't leak the user namespace when the mount fails\n\nbm_get_tree() takes a reference to the user namespace and hands it to\nget_tree_keyed() as the sget key. sget_fc() moves that reference into\nsb->s_fs_info and clears fc->s_fs_info, so from that point on the\nsuperblock owns it and bm_free() doesn't see it anymore.\n\nThe superblock drops it in ->put_super(). But generic_shutdown_super()\nonly calls ->put_super() from inside the if (sb->s_root) branch, so\nnothing releases it when bm_fill_super() fails:\n\n- The kzalloc_obj() failure leaves s_root NULL and the whole branch is\n  skipped.\n\n- A simple_fill_super() failure in the file loop leaves s_root set, but\n  s_op still points at simple_super_operations, which has no\n  ->put_super(). bm_fill_super() installs s_ops only once\n  simple_fill_super() returned success, and installing it earlier\n  wouldn't help either because simple_fill_super() overwrites s_op.\n\nEither way vfs_get_super() calls deactivate_locked_super() and the\nreference is gone for good. binfmt_misc mounts are available in a user\nnamespace and both the inode and the dentry cache are SLAB_ACCOUNT, so\nan unprivileged caller under a tight memory cgroup can fail\nsimple_fill_super() on demand and leak one user namespace per attempt.\n\nDrop the reference in ->kill_sb() instead, which runs unconditionally,\nthe same way nfsd and rpc_pipefs release their keyed s_fs_info.\n\nThat also stops ->put_super() from clearing s_fs_info while the\nsuperblock is still on @fs_supers. generic_shutdown_super() leaves it\nthere on purpose so that sget_fc() keeps finding it until kill_sb() has\nrun, but a NULL s_fs_info makes test_keyed_super() miss it, so a\nconcurrent mount for the same user namespace skips the grab_super()\nwait and creates a second superblock for a namespace that is still\nbeing torn down."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"ffec017158d3aad8a6ffca1dfad63d63bde9caad","versionType":"git","status":"affected"},{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"867aed6a4848761190d5ebdedf9642648f97bceb","versionType":"git","status":"affected"},{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"87a4eb9bbb3497f749bbac612af22ddaa62d7b0d","versionType":"git","status":"affected"},{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"b8206f516fe7cbe785cf44bf09c17c438d7c3cad","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/867aed6a4848761190d5ebdedf9642648f97bceb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87a4eb9bbb3497f749bbac612af22ddaa62d7b0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8206f516fe7cbe785cf44bf09c17c438d7c3cad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ffec017158d3aad8a6ffca1dfad63d63bde9caad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74484","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.270","lastModified":"2026-08-19T07:16:55.913","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: don't let an 'F' entry pin its own instance\n\nAn entry registered with 'F' opens its interpreter at registration time\nand holds that file until the entry is freed. Any entry nobody removes\nby hand only gets closed once the binfmt_misc superblock is shut down.\nIf the interpreter lives on a mount that keeps that superblock alive the\ntwo pin each other:\n\n    binfmt_misc sb -> inode -> entry -> interp_file -> vfsmount -> binfmt_misc sb\n\nTL;DR the file is never closed. Once the mount namespace is gone there\nis nothing left to unregister through either.\n\nThere are two ways to trigger this bug:\n\n- Point the interpreter at the instance itself. Its files are regular\n  files owned by the mounter and both bm_get_inode() and\n  simple_fill_super() leave i_op at empty_iops. So notify_change() falls\n  back to simple_setattr() and chmod +x works. We never set SB_I_NOEXEC\n  and so open_exec() accepts it.\n\n- Use the instance as an overlayfs lower layer. The overlay superblock\n  holds a clone_private_mount() of every layer until it is destroyed and\n  that clone is in no namespace. So umount_tree() never reaches it.\n\nThat's a DoS. And it isn't only the superblock that leaks. It pins the\nuser namespace it was mounted in, so every iteration permanently eats\none of the caller's user namespace charges.\n\nSo let's just do the sane thing. SB_I_NOEXEC makes open_exec() fail on\nthe instance's own files and s_stack_depth makes overlayfs reject the\nlayer before it ever takes a clone. That also covers the ecryptfs and\nfuse passthrough variants. What 'F' promises is unchanged.\n\nThe stable tag is narrower than the Fixes tags on purpose. Before\nsandboxed mounts this needed global root against the single instance\neveryone shares, and the change doesn't apply to those trees anyway.\n\nNote that SB_I_NODEV is implicitly raised for userns mounts but raise it\nexplicitly here as well."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"1cc2decee06acc939337304e9b3f737fd5d8c4bd","versionType":"git","status":"affected"},{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"4dad8ca637d44d5a6d5c23fa80c9e2e455198c2b","versionType":"git","status":"affected"},{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"098e92fe0f1bde5af99c8cf504f13f01ef139f85","versionType":"git","status":"affected"},{"version":"21ca59b365c091d583f36ac753eaa8baf947be6f","lessThan":"79055d82772b9584f259b747fe40ff56a076678d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/098e92fe0f1bde5af99c8cf504f13f01ef139f85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1cc2decee06acc939337304e9b3f737fd5d8c4bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dad8ca637d44d5a6d5c23fa80c9e2e455198c2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/79055d82772b9584f259b747fe40ff56a076678d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74485","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.380","lastModified":"2026-08-19T17:21:05.660","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: reject a flag character as the field delimiter\n\nThe registration string starts with a user chosen delimiter that\nseparates the individual fields. So that the field parsers terminate\neven on a truncated string create_entry() pads the buffer with that\nsame delimiter:\n\n\tmemset(buf + count, del, 8);\n\nMost fields are scanned for the delimiter with strchr()/scanarg() and\nhappily stop on the padding. The flags field is different: instead of\nscanning for the delimiter check_special_flags() consumes the flag\ncharacters 'P', 'O', 'C' and 'F' and stops at the first byte that is\nnone of them, relying on the trailing delimiter to end the scan.\n\nIf the delimiter is itself a flag character the padding no longer acts\nas a terminator. The scan swallows all eight padding bytes and keeps\nreading past the end of the allocation until it hits a byte that is\nnot a flag character. For example registering\n\n\tPaPEPPxPPiP\n\nwith 'P' as the delimiter (name \"a\", type extension, magic \"x\",\ninterpreter \"i\", empty flags) leaves the flag scan running off the end\nof the buffer. The registration is rejected in the end because the\nparser does not stop exactly at buf + count, but only after the out of\nbounds read has already happened. With an unlucky allocation layout the\nscan can walk into an unmapped page; under KASAN it is reported as a\nslab out of bounds read. binfmt_misc mounts are available to\nunprivileged users in a user namespace so the read is reachable without\nprivileges.\n\nReject a delimiter that is one of the flag characters up front. Such a\nregistration was always rejected anyway, only after the out of bounds\nread, so no valid registration string changes meaning."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"96bd5d4fea2970b9b08265293ca7a10b9b27c0fd","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9970e094e5d60f0d66914bf9a97d1ef19107ebf5","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b29e3c1f375c1296362d219ff38bceddf2d2a88a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1819f82dee766c58295ecaacdac02cdf6837d7a4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"840bb9c49c3e75fb32b593d67ab32f6b77122262","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9a2d87db3898b5993b64fd258d0334e0eba9ee0d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8e85d50ba1117fd446bf9a250bd8a97d48384bdc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/1819f82dee766c58295ecaacdac02cdf6837d7a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/840bb9c49c3e75fb32b593d67ab32f6b77122262","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e85d50ba1117fd446bf9a250bd8a97d48384bdc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96bd5d4fea2970b9b08265293ca7a10b9b27c0fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9970e094e5d60f0d66914bf9a97d1ef19107ebf5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a2d87db3898b5993b64fd258d0334e0eba9ee0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b29e3c1f375c1296362d219ff38bceddf2d2a88a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74486","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.497","lastModified":"2026-08-23T13:16:44.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: use exe_file_deny_write_access() for the interpreter clone\n\nFor MISC_FMT_OPEN_FILE entries load_misc_binary() clones the\nregistered interpreter file and denies write access to the clone via\nplain deny_write_access(). The clone is installed as\nbprm->interpreter and later released by the exec machinery through\nexe_file_allow_write_access() which skips the i_writecount increment\nfor files with FMODE_FSNOTIFY_HSM set.\n\nThe deny and allow side can therefore come to different conclusions\nwhen pre-content watches are in play: if a pre-content watch is added\nto the interpreter after registration every subsequent exec through\nthat entry takes a write denial on the clone that is never paired\nwith a write allowance, driving the interpreter inode's i_writecount\nfurther down with each exec and leaving the interpreter unwritable\neven after the entry and all its users are gone.\n\nTake the write denial via exe_file_deny_write_access() so both sides\nof the pairing base their decision on the same file mode, and\npropagate failure instead of silently ignoring it: an interpreter\nthat is concurrently open for writing now fails the exec with\nETXTBSY, exactly like an interpreter freshly opened via open_exec()\nwould."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5b432413f7bbbc8b935138490a57be05c1921684","lessThan":"c65eb018c12179b5e2c7afe1f0956298576fecec","versionType":"git","status":"affected"},{"version":"bb4715098d8e340bbbdd3a874b31f89867c8067e","lessThan":"2bd860b7e752a51185960143cab9fec7bf32c84e","versionType":"git","status":"affected"},{"version":"c152be5adc0975c75cc4f50891c9072d52d60b47","lessThan":"eea4b7c7711b1e425272d23352af157f45f4c3e3","versionType":"git","status":"affected"},{"version":"bf5ed2ef5cdb7b47ce606e3d48ea6eb803b31503","lessThan":"2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9","versionType":"git","status":"affected"},{"version":"483217fd6f7ccd98b3ed2531a54f75ed144b4499","lessThan":"f1e7ea3c8e070f19771cdaef55bbeda1359ad490","versionType":"git","status":"affected"},{"version":"0357ef03c94ef835bd44a0658b8edb672a9dbf51","lessThan":"255a758697da87a205e072e0cfc35897b8f743b1","versionType":"git","status":"affected"},{"version":"0357ef03c94ef835bd44a0658b8edb672a9dbf51","lessThan":"f0edbaf487e4653a680a7abb91c1df94cb7886aa","versionType":"git","status":"affected"},{"version":"0357ef03c94ef835bd44a0658b8edb672a9dbf51","lessThan":"fa5990ca8fd917003e526036bcc50413edb9722c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/255a758697da87a205e072e0cfc35897b8f743b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bd860b7e752a51185960143cab9fec7bf32c84e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c65eb018c12179b5e2c7afe1f0956298576fecec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eea4b7c7711b1e425272d23352af157f45f4c3e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0edbaf487e4653a680a7abb91c1df94cb7886aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1e7ea3c8e070f19771cdaef55bbeda1359ad490","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa5990ca8fd917003e526036bcc50413edb9722c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74487","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.593","lastModified":"2026-08-23T13:16:44.750","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access when removing an entry\n\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write access to it for as\nlong as the entry exists. Removing the entry closes the interpreter\nfile via filp_close() but never restores write access, leaving the\ninode's i_writecount permanently negative. Opening the interpreter\nfor writing keeps failing with ETXTBSY long after the entry is gone\nuntil the inode is evicted from the inode cache.\n\nCommit 90f601b497d7 (\"binfmt_misc: restore write access before\nclosing files opened by open_exec()\") fixed the same imbalance in the\nerror path of bm_register_write() but the actual removal path has\nbeen leaking the write denial since the introduction of the flag.\n\nRestore write access in put_binfmt_handler() before closing the\ninterpreter file."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"7873f987213695e3564c8c259e6db283e4739472","versionType":"git","status":"affected"},{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"13efc628fdf641d901bdba07caa1c558e1bed046","versionType":"git","status":"affected"},{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"f1cf67f6be0babc73afa4ee0e27bdedffeeeb095","versionType":"git","status":"affected"},{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c","versionType":"git","status":"affected"},{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8","versionType":"git","status":"affected"},{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"fdc1d702bf3001586221fa07e598e876a0a854c5","versionType":"git","status":"affected"},{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"3b522487a3a9162b1b519eefde7998d103e3e07b","versionType":"git","status":"affected"},{"version":"948b701a607f123df92ed29084413e5dd8cda2ed","lessThan":"db1856ea9196cf6e015d12199a34c0b9313c7bfa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/binfmt_misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/13efc628fdf641d901bdba07caa1c558e1bed046","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b522487a3a9162b1b519eefde7998d103e3e07b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7873f987213695e3564c8c259e6db283e4739472","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db1856ea9196cf6e015d12199a34c0b9313c7bfa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1cf67f6be0babc73afa4ee0e27bdedffeeeb095","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdc1d702bf3001586221fa07e598e876a0a854c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74488","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.690","lastModified":"2026-08-19T17:21:05.847","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames\n\nmwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with\nieee80211_amsdu_to_8023s() and walks the resulting subframes. For each\nsubframe it passes the subframe data pointer to\nmwifiex_process_tdls_action_frame(), but pairs it with skb->len, the\nlength of the A-MSDU parent, instead of rx_skb->len:\n\n\trx_skb = __skb_dequeue(&list);\n\trx_hdr = (struct rx_packet_hdr *)rx_skb->data;\n\tif (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&\n\t    ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {\n\t\tmwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,\n\t\t\t\t\t\t  skb->len);\n\t}\n\nThe parent is not a valid description of that buffer, and may not be\nvalid memory at all. ieee80211_amsdu_to_8023s() ends with\n\n\tif (!reuse_skb)\n\t\tdev_kfree_skb(skb);\n\nand it only sets reuse_skb when the parent is linear, is not a\nhead_frag, and is being consumed as the *last* subframe. So when the\nparent does not qualify for reuse it has already been freed, and the\nread of skb->len is a use-after-free. When it is reused, skb->len is\nthe length of the last subframe, applied to every earlier subframe,\nwhich over-states the buffer whenever an earlier subframe is shorter.\n\nThe callee cannot absorb a wrong length, because it derives its own\nceiling from the value it is given. Each frame type computes\n\n\ties_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;\n\nand the element walk is then bounded entirely against that ceiling,\n\n\tfor (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) {\n\t\tu8 ie_len = pos[1];\n\n\t\tif (pos + 2 + ie_len > end)\n\t\t\tbreak;\n\nso a too-large len moves end past the end of the subframe and the walk\nreads and copies beyond it. The A-MSDU layout is chosen by the sender,\nwhich makes the difference between the last subframe and a shorter\nearlier one remotely selectable. Reaching this requires TDLS support in\nfirmware and the TDLS ethertype on the subframe.\n\nThe other caller, mwifiex_process_rx_packet(), is correct: it passes a\npointer and a length that describe the same region of the RX buffer.\n\nPass rx_skb->len, the length of the subframe actually being parsed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"707664027bb9307f7268eda403af7c4ccd9b8644","versionType":"git","status":"affected"},{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"3b02275833a0d3e6583627995d614fa99bdf364f","versionType":"git","status":"affected"},{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"a1f0f7dc7eb15754e6931b433edb7beb754c996a","versionType":"git","status":"affected"},{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79","versionType":"git","status":"affected"},{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"ece2ebb34247d573142617dfc534a9dc11ba59be","versionType":"git","status":"affected"},{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"c9dcfe6b8b71369e1d732e2ff622c3696a2f032c","versionType":"git","status":"affected"},{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"5a21ab03829cb6d2682c127f22e2b9cd63b4393f","versionType":"git","status":"affected"},{"version":"776f742040ca5eb6242c60f29ac73d5752a5b621","lessThan":"99a948382af8a225e2d5e54a7052158cd6281cc6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b02275833a0d3e6583627995d614fa99bdf364f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a21ab03829cb6d2682c127f22e2b9cd63b4393f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/707664027bb9307f7268eda403af7c4ccd9b8644","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99a948382af8a225e2d5e54a7052158cd6281cc6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1f0f7dc7eb15754e6931b433edb7beb754c996a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9dcfe6b8b71369e1d732e2ff622c3696a2f032c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ece2ebb34247d573142617dfc534a9dc11ba59be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74489","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.813","lastModified":"2026-08-17T06:19:45.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix tid_tx use-after-free on BA session stop\n\nieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through\nieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping\nsta->lock:\n\n\tieee80211_remove_tid_tx(sta, tid);\t/* kfree_rcu(tid_tx, rcu_head) */\n\t...\n\tspin_unlock_bh(&sta->lock);\n\n\tif (start_txq)\n\t\tieee80211_agg_start_txq(sta, tid, false);\n\n\tif (send_delba)\n\t\tieee80211_send_delba(..., tid_tx->ndp);\n\nThat read is not covered by an RCU read-side critical section, and it runs\nin preemptible process context: both callers hold the wiphy mutex, reaching\nit either from the ieee80211_ba_session_work() wiphy work or from\nieee80211_sta_tear_down_BA_sessions() during station teardown.\nSoftirqs can run in that window too, both from the local_bh_enable() that\nends ieee80211_agg_start_txq() and from any interrupt exit, so the RCU\ncallback can free tid_tx before the read.\n\nDriving the function from a test module with the grace period forced into\nthat window, KASAN reports the read, and the free arrives on the ordinary\nRCU softirq path:\n\n  BUG: KASAN: slab-use-after-free in ieee80211_stop_tx_ba_cb+0x3cd/0x400\n  Read of size 1 at addr ffff888002b9f52e by task kworker/0:1/10\n  [...]\n  Freed by task 57:\n   __kasan_slab_free+0x47/0x70\n   __rcu_free_sheaf_prepare+0x70/0x250\n   rcu_free_sheaf_nobarn+0x18/0x40\n   rcu_core+0x426/0x1310\n   handle_softirqs+0x144/0x590\n   __irq_exit_rcu+0xea/0x150\n   irq_exit_rcu+0x9/0x20\n   sysvec_apic_timer_interrupt+0x6b/0x80\n   asm_sysvec_apic_timer_interrupt+0x1a/0x20\n\nsend_delba is only set when tx_stop is set, which happens for\nAGG_STOP_LOCAL_REQUEST alone, so this is reached on local teardown -\nsession idle timeout, PTK rekey, suspend, HW reconfig - and not from a\npeer's DELBA.\n\nRead ndp into a local before the session is freed, while sta->lock is still\nheld. tid_tx->ndp has a single writer, in\nieee80211_tx_ba_session_handle_start(), which cannot run concurrently here:\nboth paths are serialised by the wiphy mutex, and the session is already\nmarked HT_AGG_STATE_STOPPING at this point. tid_tx->ndp is also the only\ntid_tx dereference left after ieee80211_remove_tid_tx() in this function.\n\n[move/change the comment a bit to be more general not just on ndp,\n initialize ndp directly]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/agg-tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"98acd4c1d9f7dc9c426e840c16e81b57315ff84b","lessThan":"09fc36eec7841cdf732f4db39855e0c73bd075cc","versionType":"git","status":"affected"},{"version":"98acd4c1d9f7dc9c426e840c16e81b57315ff84b","lessThan":"2f067f5a450ea07efd249142a11d940a068fe29c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/agg-tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/09fc36eec7841cdf732f4db39855e0c73bd075cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f067f5a450ea07efd249142a11d940a068fe29c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74490","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:53.917","lastModified":"2026-08-19T17:21:06.030","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: avoid use-after-free in poll trace queue dumps\n\nTIPC socket tracepoints dump queue state through tipc_sk_dump(). Most\nqueue-dump callsites already serialize that walk under the socket lock or\nsk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(...,\nTIPC_DUMP_ALL, ...) without holding either lock.\n\nThat lets the poll trace path reach tipc_list_dump() and backlog head/tail\ndumping while another context dequeues and frees an skb, leaving the trace\nhelper dereferencing a stale queue entry.\n\nStop the unlocked poll trace site from requesting queue dumps. Other queue\ndump trace callsites keep their existing output under the locking they\nalready provide, while poll still emits the event itself without walking\nlive queue members from an unlocked context."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/tipc/socket.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"3cd57c6b210d50fd1f7ac1720442ba5be5dc94f8","versionType":"git","status":"affected"},{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"ae7fc824970888b4fdaa076819c9a6f2fcede275","versionType":"git","status":"affected"},{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"78706367fe1b98aee0a6de27c62b7f1e3035f38d","versionType":"git","status":"affected"},{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"d7940bb6a8e7ab28f972c2875cb05783216312dc","versionType":"git","status":"affected"},{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d","versionType":"git","status":"affected"},{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"bed792737b5f1ba773054dbe984502958bdfe6ce","versionType":"git","status":"affected"},{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"ac2f787980fdf4364cd5651a4c8128e59b8de3aa","versionType":"git","status":"affected"},{"version":"b4b9771bcbbd5839b0f77aba55e2f85989ed6779","lessThan":"b4f1719dfea023220e0e6bd892b087d76b2a6a49","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/tipc/socket.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3cd57c6b210d50fd1f7ac1720442ba5be5dc94f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78706367fe1b98aee0a6de27c62b7f1e3035f38d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac2f787980fdf4364cd5651a4c8128e59b8de3aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae7fc824970888b4fdaa076819c9a6f2fcede275","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4f1719dfea023220e0e6bd892b087d76b2a6a49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bed792737b5f1ba773054dbe984502958bdfe6ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7940bb6a8e7ab28f972c2875cb05783216312dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74491","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.020","lastModified":"2026-08-17T06:19:45.413","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/address: Fix NULL bus dereference in of_pci_range_parser_one()\n\nThe bus matching rework made of_match_bus() return NULL for nodes with\nranges/dma-ranges but no local #address-cells. parser_init() stored that\nNULL bus, and the range iterator later dereferenced it.\n\nReject such nodes in parser_init(), leaving an explicit empty\niterator for callers that ignore the init return, and make\nof_dma_get_max_cpu_address() honour the init failure so a rejected node\ncannot clamp the DMA limit."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/of/address.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"64ee3cf096ac590e7da2ceac1c390546bff5e240","lessThan":"88752b811f72aa7a16de6dad4b25031d7308673e","versionType":"git","status":"affected"},{"version":"64ee3cf096ac590e7da2ceac1c390546bff5e240","lessThan":"eddd0159a8761a16a9d183676b03cf493417816e","versionType":"git","status":"affected"},{"version":"64ee3cf096ac590e7da2ceac1c390546bff5e240","lessThan":"bba13ad17b1a11b3f1ed9b3a5d556191d7755a59","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/of/address.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/88752b811f72aa7a16de6dad4b25031d7308673e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bba13ad17b1a11b3f1ed9b3a5d556191d7755a59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eddd0159a8761a16a9d183676b03cf493417816e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74492","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.120","lastModified":"2026-08-19T17:21:06.203","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: do not update comments from kernel-side hash adds\n\nmtype_resize() copies comment pointers with memcpy(), not the comment\nobjects themselves. During the window after an entry has been copied but\nbefore the table swap and backlog replay, the old table is still\npublished for packet-side updates while the replacement-table entry\nalready holds the same ip_set_comment_rcu pointer.\n\nIf xt_SET --add-set ... --exist hits that old entry in this window,\nmtype_add() calls ip_set_init_comment() even though packet-side adds\ncarry no comment payload. That call frees the shared comment through the\nold entry, so the replacement-table entry now holds a stale pointer.\nWhen the queued add is replayed on the new table, mtype_add() calls\nip_set_init_comment() again and strlen() dereferences the stale pointer.\n\nFix this in mtype_add() by skipping ip_set_init_comment() when\next->target marks a packet-side add. Userspace adds still update\ncomments, while packet-side adds can no longer free comment storage\nshared with a resize copy."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/ipset/ip_set_hash_gen.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"6f13f4d52d06986c18f12e8bffaab944dd27ceab","versionType":"git","status":"affected"},{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"f9d6cabff1fca010562dcdb0d22b296bdca3ba5a","versionType":"git","status":"affected"},{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"16bfa7be2d76ca1e0aacfa363482e1bf8ab5042a","versionType":"git","status":"affected"},{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"661ff9c0cfbe07f8eed920dde9f7781491738207","versionType":"git","status":"affected"},{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"c710e9bf38e4e71a8db85d26a0f70c0674664207","versionType":"git","status":"affected"},{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"4ae701848e4ba9e9713375fb7d82218cbd309da2","versionType":"git","status":"affected"},{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"77dbb248a5cc7a5270cd37bbb0b635bf059a872a","versionType":"git","status":"affected"},{"version":"f66ee0410b1c3481ee75e5db9b34547b4d582465","lessThan":"f30415929be8aeb002d557c8d3f7ab2d2188003a","versionType":"git","status":"affected"},{"version":"5dd9488ae41070b69d2f4acb580f77db5705f9ca","versionType":"git","status":"affected"},{"version":"a469bab3386aebff33c59506f3a95e35b91118fd","versionType":"git","status":"affected"},{"version":"5.4.24","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.5.8","lessThan":"5.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/ipset/ip_set_hash_gen.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/16bfa7be2d76ca1e0aacfa363482e1bf8ab5042a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ae701848e4ba9e9713375fb7d82218cbd309da2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/661ff9c0cfbe07f8eed920dde9f7781491738207","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f13f4d52d06986c18f12e8bffaab944dd27ceab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77dbb248a5cc7a5270cd37bbb0b635bf059a872a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c710e9bf38e4e71a8db85d26a0f70c0674664207","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f30415929be8aeb002d557c8d3f7ab2d2188003a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9d6cabff1fca010562dcdb0d22b296bdca3ba5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74493","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.240","lastModified":"2026-08-19T17:21:06.470","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix socket use-after-free during link group termination\n\n__smc_lgr_terminate() drops conns_lock after finding a connection in\nlgr->conns_all, but before taking a reference on its socket. The connection\nis embedded in the socket, and its registration reference protects it only\nwhile the connection remains in the tree.\n\nA concurrent close can unregister the connection and drop that reference,\nfreeing the socket before the termination worker reaches sock_hold().\n\nThe race is reachable when close overlaps link group termination.\nLocal stress testing reproduced the use-after-free and KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in __smc_lgr_terminate.part.0 [smc]\n  Write of size 4 by task kworker/3:3\n  Workqueue: events smc_lgr_terminate_work [smc]\n  __smc_lgr_terminate.part.0 [smc]\n\nThe socket was allocated by smc_create(), freed through\nslab_free_after_rcu_debug(), and was followed by:\n\n  refcount_t: addition on 0; use-after-free.\n  __smc_lgr_terminate.part.0 [smc]\n\nTake the socket reference while conns_lock still protects the tree entry.\nThe unregister path then cannot drop the last reference until termination\nhas finished using the socket."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/smc/smc_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"ff44f2df57fb5560bdc75eb977867643e764a262","versionType":"git","status":"affected"},{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"9fb17c95b8f0683570fca1fb2792264147af937a","versionType":"git","status":"affected"},{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"bea8dc14de2d56aca749d368563e6888217710a5","versionType":"git","status":"affected"},{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"5a42f162b857019a4c10ff687dc3bcdf51831865","versionType":"git","status":"affected"},{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"281c103a8eaed59001ce952f231df1b07674215a","versionType":"git","status":"affected"},{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"f807a63d0d95680c34f677700da9148a07d7c78f","versionType":"git","status":"affected"},{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"f0541a775d04c88e90ba448e35ce0d743512822a","versionType":"git","status":"affected"},{"version":"69318b5215f2dc32c345a3d65b98b4b1bf29c007","lessThan":"f621d6ebeebb6374342571e4ddf45fdbc420f6cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/smc/smc_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/281c103a8eaed59001ce952f231df1b07674215a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a42f162b857019a4c10ff687dc3bcdf51831865","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9fb17c95b8f0683570fca1fb2792264147af937a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bea8dc14de2d56aca749d368563e6888217710a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0541a775d04c88e90ba448e35ce0d743512822a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f621d6ebeebb6374342571e4ddf45fdbc420f6cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f807a63d0d95680c34f677700da9148a07d7c78f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff44f2df57fb5560bdc75eb977867643e764a262","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74494","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.353","lastModified":"2026-08-23T13:16:44.870","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reject repeated SMB2 NEGOTIATE requests\n\nUnauthenticated client can send multiple successful SMB2 NEGOTIATE\nrequests on one connection before SESSION_SETUP. While the connection is\nin KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() accepts another\nSMB3.1.1 NEGOTIATE and overwrites conn->preauth_info with a new allocation.\nOnly the final allocation is freed when the connection is released, leaking\none object for every additional successful request.\n\nA repeated SMB2 NEGOTIATE after a dialect has been selected is a protocol\nviolation. MS-SMB2 section 3.3.5.4 requires the server to disconnect\nwithout replying in this case. Set the connection exiting when rejecting\nthe request, in addition to suppressing the response.\n\nReject SMB2 NEGOTIATE unless the connection is new or is waiting for the\nSMB2 NEGOTIATE that follows an SMB1 multi-protocol negotiate. Serialize\nboth SMB1 and SMB2 negotiation paths under conn->srv_mutex, since they\nupdate connection-wide dialect and negotiation state.\n\nMove the locking contract to ksmbd_smb_negotiate_common(), where the state\nand dialect are selected, and add ksmbd_conn_new() for consistent state\naccess."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/connection.h","fs/smb/server/smb2pdu.c","fs/smb/server/smb_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"0b1390cf2b6b91723b37c0909dd123f7a5eba1a7","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"fd6a6c43f96b40a08a22ff62f08d194a49741c8a","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"81e21cb7bd1479bb5238e0004a7e0110452c610b","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"7fb8dbeb3f2868ae836ca12311d89aed16fc2927","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"a60b5da05e318d9a364dbac38c347c7f24e625e7","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"cb469993b3a61a72653770856d37af616d72d05f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/connection.h","fs/smb/server/smb2pdu.c","fs/smb/server/smb_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.153","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b1390cf2b6b91723b37c0909dd123f7a5eba1a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e02cb30e8a1f5fc78cb10b220b06020e36d0bbe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7fb8dbeb3f2868ae836ca12311d89aed16fc2927","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81e21cb7bd1479bb5238e0004a7e0110452c610b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a60b5da05e318d9a364dbac38c347c7f24e625e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb469993b3a61a72653770856d37af616d72d05f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd6a6c43f96b40a08a22ff62f08d194a49741c8a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74495","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.453","lastModified":"2026-08-19T17:21:06.680","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nigbvf: Fix leak in TX DMA error cleanup\n\nIf an error is encountered while mapping TX buffers, the driver should\nunmap any buffers already mapped for that skb.\n\nBecause count is incremented before each frag mapping, it will always\nmatch the correct number of unmappings needed when dma_error is reached.\nDecrementing count before the while loop in dma_error causes an\noff-by-one error. If any mapping was successful before an unsuccessful\nmapping, exactly one DMA mapping (the head) would leak.\n\nThis bug was introduced by a 2010 fix for an endless loop in dma_error.\nAll other affected drivers have already been fixed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/intel/igbvf/netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"e42b7225c45f57b42306b80cdd3bda202bae7293","versionType":"git","status":"affected"},{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"e3ed89c257f6361f13df23023cd10ace830330ad","versionType":"git","status":"affected"},{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"56726ff12cb6759ab90d6f5332c2377aeca7d249","versionType":"git","status":"affected"},{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"31089f4eab42e0fc248ec80c26f9b0bad59ba4cc","versionType":"git","status":"affected"},{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"bc25d56c03e41c10bc4b40e99ca5d7b941675c04","versionType":"git","status":"affected"},{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"845a9cdd9b03b7b6fa8de3ee80579780350a7f65","versionType":"git","status":"affected"},{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"df07003b5a6c6c9fce60d765d6a3da815a74c41c","versionType":"git","status":"affected"},{"version":"c1fa347f20f17f14a4a1575727fa24340e8a9117","lessThan":"0565052b7e2f436b7f1541f4849da96dc0aa7a0e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/intel/igbvf/netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0565052b7e2f436b7f1541f4849da96dc0aa7a0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/31089f4eab42e0fc248ec80c26f9b0bad59ba4cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56726ff12cb6759ab90d6f5332c2377aeca7d249","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/845a9cdd9b03b7b6fa8de3ee80579780350a7f65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc25d56c03e41c10bc4b40e99ca5d7b941675c04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df07003b5a6c6c9fce60d765d6a3da815a74c41c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3ed89c257f6361f13df23023cd10ace830330ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e42b7225c45f57b42306b80cdd3bda202bae7293","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74496","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.557","lastModified":"2026-08-17T06:19:45.953","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfou: Fix use-after-free in fou_create()\n\nfou_create() publishes struct fou through sk_user_data before adding the\nnew FOU port to the per-netns list.  If fou_add_to_port_list() fails,\nthe error path frees fou while it is still reachable through\nsk_user_data.  A concurrent receive can then dereference the freed\nobject in fou_from_sock().\n\nThis ordering issue was previously noted in the linked discussion.\n\nThe failure is reachable when local port 0 is requested.  Each socket\nbinds to a different ephemeral port, but fou_cfg_cmp() compares the\nrequested port 0 and reports -EALREADY once an entry already exists.\n\nRelease the tunnel socket before freeing fou so sk_user_data is cleared\nfirst, and defer reclamation with kfree_rcu() to protect concurrent RCU\nreaders.  This matches the lifetime handling in fou_release()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/fou_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"23461551c00628c3f3fe9cf837bf53cf8f212b63","lessThan":"a28d8903bfe76089ea4bbdbff9976965f9ef8107","versionType":"git","status":"affected"},{"version":"23461551c00628c3f3fe9cf837bf53cf8f212b63","lessThan":"b14361aca6350ff7907b0e9903c7b94dc7d5d4a0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/fou_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.18","status":"affected"},{"version":"0","lessThan":"3.18","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/a28d8903bfe76089ea4bbdbff9976965f9ef8107","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b14361aca6350ff7907b0e9903c7b94dc7d5d4a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74497","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.657","lastModified":"2026-08-19T17:21:06.910","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Clamp frame size in implicit-feedback mode\n\nsnd_usb_handle_sync_urb() scales received sync packet sizes by the sender's\nstride and stores the result directly in out_packet->packet_size[i]. If a\nconnected USB device sends an oversized sync packet, this frame count can\nexceed ep->maxframesize.\n\nThe un-clamped frame count then propagates to the playback endpoint queue,\npotentially driving packet transfers beyond the endpoint's hardware frame\nlimits.\n\nCap the calculated frame count against ep->maxframesize in\nsnd_usb_handle_sync_urb() to prevent oversized packets from entering the\nplayback queue."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/endpoint.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"2d39fea6d3c19a2f5811d123114d92e3d0115fd1","versionType":"git","status":"affected"},{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"09cf3dbbb4256a43feb91d2f51f274510a9ada47","versionType":"git","status":"affected"},{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"cfa8d3e0e8b812c4db4d5241f62b6bdbab2bd7be","versionType":"git","status":"affected"},{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"56ac3e7c90f6b45969c3fd07a98fad760ffd6901","versionType":"git","status":"affected"},{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"be97fea7451d758881b95af78e900dd0d58a382a","versionType":"git","status":"affected"},{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"2db4535d6af79276a64449201c5be5feffb31c64","versionType":"git","status":"affected"},{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"53f0aa37eb945f3c983f61d12fc35eb33debb8a9","versionType":"git","status":"affected"},{"version":"28acb12014fb0c3e1edfdab1b1e3e266cf651550","lessThan":"8d7a30c50c2e58a6839634ed0acde14466d1dc61","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/endpoint.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/09cf3dbbb4256a43feb91d2f51f274510a9ada47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2d39fea6d3c19a2f5811d123114d92e3d0115fd1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2db4535d6af79276a64449201c5be5feffb31c64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53f0aa37eb945f3c983f61d12fc35eb33debb8a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56ac3e7c90f6b45969c3fd07a98fad760ffd6901","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d7a30c50c2e58a6839634ed0acde14466d1dc61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be97fea7451d758881b95af78e900dd0d58a382a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfa8d3e0e8b812c4db4d5241f62b6bdbab2bd7be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74498","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.760","lastModified":"2026-08-19T17:21:07.203","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set\n\nWhen a USB audio endpoint requests full packet transfers via the fill_max\ndescriptor flag, data_ep_set_params() promotes ep->curpacksize to\nep->maxpacksize. However, maxsize is left at the original sample-rate\nderived value.\n\nSince u->buffer_size is allocated as maxsize * packets, the resulting\nDMA buffer is far too small for the requested transfer length. When the\nUSB host controller streams up to curpacksize bytes per packet, it writes\npast the end of the buffer via DMA, corrupting kernel heap memory.\n\nUpdate maxsize to curpacksize when fill_max is set so that the allocated\nDMA buffer size matches the actual transfer request size.\n\n[ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/endpoint.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"10c24e6fddf4bdff0b6b05a47a4347b38e6960e8","versionType":"git","status":"affected"},{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"b1770f9ac35c0ffc34914d52347c65dcd5ac049b","versionType":"git","status":"affected"},{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"6cbdd11f9b05b92f4aa29f09a66e19ed0e25e66c","versionType":"git","status":"affected"},{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"3852974608f53e530e27c21d0c6c7d79c17b3f5a","versionType":"git","status":"affected"},{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"f9b6c9576568169139ac151f7881474f384659fd","versionType":"git","status":"affected"},{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"04595233e5606d452f9f47e6989fc7ae7440fd40","versionType":"git","status":"affected"},{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"bd65b7191683bebd9923904f0558b9211b9129da","versionType":"git","status":"affected"},{"version":"8fdff6a319e7dac757c558bd283dc4577e68cde7","lessThan":"d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/endpoint.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.5","status":"affected"},{"version":"0","lessThan":"3.5","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/04595233e5606d452f9f47e6989fc7ae7440fd40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/10c24e6fddf4bdff0b6b05a47a4347b38e6960e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3852974608f53e530e27c21d0c6c7d79c17b3f5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cbdd11f9b05b92f4aa29f09a66e19ed0e25e66c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1770f9ac35c0ffc34914d52347c65dcd5ac049b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd65b7191683bebd9923904f0558b9211b9129da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9b6c9576568169139ac151f7881474f384659fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74499","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.863","lastModified":"2026-08-19T17:21:07.360","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\n\nsnd_usbmidi_akai_output() computes its fill-loop bound\n\n\tbuf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;\n\nas a signed int, so a small device-advertised bulk-OUT max_transfer\nmakes buf_end negative.  The loop guard then compares the u32\nurb->transfer_buffer_length against that negative int: the usual\narithmetic conversion turns buf_end into a large unsigned value, so the\nguard stays true and each iteration keeps appending SysEx framing and\npayload bytes past the end of the URB transfer buffer, which is only\nmax_transfer bytes long.\n\nA USB device that advertises a tiny bulk-OUT endpoint can therefore\ntrigger an attacker-length- and content-controlled heap out-of-bounds\nwrite when a process writes to the created /dev/snd/midiC*D* node.\n\nReturn early when there is no room for even one SysEx, so the loop is\nnever entered with a bound that would wrap.  The loop is the last\nstatement of the function, so bailing out is equivalent to it not\nrunning.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/midi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"78dfdeb8d2065524ed5928d6470bf3d3244d1009","versionType":"git","status":"affected"},{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"00cc659a42ac4e94ec880fae2c9bf22fce69c2e8","versionType":"git","status":"affected"},{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"ce949d66607cfb000b8d8d84f80f35a886e72683","versionType":"git","status":"affected"},{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"29a4c29943631301e85f5e9d10f25741bd78e7ba","versionType":"git","status":"affected"},{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"9b22a5c8310b0d55d04f5f0159b913a2fb8b444f","versionType":"git","status":"affected"},{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081","versionType":"git","status":"affected"},{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"2b7a0f330dd90dd1a7657cec0db019ee1efa4372","versionType":"git","status":"affected"},{"version":"4434ade8c9334a3ab975d8993de456f06841899e","lessThan":"0970274613fb463d376211450cab066d34ebfe6a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/midi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.35","status":"affected"},{"version":"0","lessThan":"2.6.35","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00cc659a42ac4e94ec880fae2c9bf22fce69c2e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78dfdeb8d2065524ed5928d6470bf3d3244d1009","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce949d66607cfb000b8d8d84f80f35a886e72683","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74500","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:54.970","lastModified":"2026-08-17T06:19:46.447","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix stack info leak in RME Digiface status\n\nsnd_rme_digiface_read_status() reads a four-word status block from the\ndevice into an uninitialised on-stack __le32 buf[4] and, whenever the\nvendor control-IN transfer does not return a negative error, copies all\nfour words into the caller's status[].\n\nsnd_usb_ctl_msg() copies the full requested size back into the caller's\nbuffer regardless of how many bytes the data stage actually delivered:\n\n\tbuf = kmemdup(data, size, GFP_KERNEL);\n\terr = usb_control_msg(dev, pipe, request, requesttype,\n\t\t\t      value, index, buf, size, timeout);\n\tmemcpy(data, buf, size);\n\nusb_control_msg() returns the transferred length on a short control-IN,\nwhich is a non-negative value, and writes only that many bytes.  The\nremainder of the copy back is the kmemdup()ed image of the caller's\nbuffer, so a device answering with a short data stage leaves the\ntrailing words of buf[] holding leftover kernel stack.  The only guard\nin the caller is err < 0, so those words are stored into status[].\n\nThey then reach user space: snd_rme_digiface_get_status_val() selects a\n16-bit halfword of status[] per the control's reg/mask, and the eight\nDigiface status controls together expose the whole 16-byte frame to an\nunprivileged reader of /dev/snd/controlC*.\n\nZero-initialise the buffer so a short read yields zeros instead of stack\nresidue.  This mirrors snd_rme_get_status1(), which already clears its\noutput word before the same kind of vendor read.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/mixer_quirks.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"611a96f6acf2e74fe28cb90908a9c183862348ce","lessThan":"b3a346d5c99dd73cf84711f2a43e42691990efd2","versionType":"git","status":"affected"},{"version":"611a96f6acf2e74fe28cb90908a9c183862348ce","lessThan":"7ba01e0d3539d9cf0aef3e82938f1648147744cc","versionType":"git","status":"affected"},{"version":"611a96f6acf2e74fe28cb90908a9c183862348ce","lessThan":"98dbfbb38e297c25c5b0af4a9018d71ac25e8554","versionType":"git","status":"affected"},{"version":"611a96f6acf2e74fe28cb90908a9c183862348ce","lessThan":"441aaad150c57edaf57ee482a79a3bf4c5b7e353","versionType":"git","status":"affected"},{"version":"3089703ab71484a8b9a7641051181d11d60f870c","versionType":"git","status":"affected"},{"version":"50f63f11a6ddaa0d34574df72b3fa6ee257c057d","versionType":"git","status":"affected"},{"version":"6.10.14","lessThan":"6.11","versionType":"semver","status":"affected"},{"version":"6.11.3","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/mixer_quirks.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/441aaad150c57edaf57ee482a79a3bf4c5b7e353","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ba01e0d3539d9cf0aef3e82938f1648147744cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98dbfbb38e297c25c5b0af4a9018d71ac25e8554","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3a346d5c99dd73cf84711f2a43e42691990efd2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74501","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.093","lastModified":"2026-08-17T06:19:46.547","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix use-after-free in ump_to_endpoint()\n\ncreate_midi2_ump() registers a card-owned snd_ump_endpoint and stores a\nback-pointer to its per-interface snd_usb_midi2_ump object in\nump->private_data, but it never installs an ump->private_free hook and\nnever clears that pointer.\n\nIf a later step of snd_usb_midi_v2_create() fails, its error path calls\nfree_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while\nthe already-registered endpoint keeps pointing at it.  The created\n/dev/snd/umpC*D* node stays exposed, so the first operation of any UMP\nopen, ump_to_endpoint(), dereferences the dangling ump->private_data and\nreads rmidi->eps[dir] out of freed memory.\n\nA malicious USB MIDI 2.0 device that makes creation fail after the\nendpoint is registered can thus trigger a slab use-after-free read on a\nsubsequent open of the UMP node.\n\nClear the endpoint's back-pointer before freeing the object, and let\nump_to_endpoint() tolerate a NULL private_data so the open/close/trigger\ncallbacks fail cleanly (their callers already handle a NULL endpoint)\ninstead of dereferencing a stale pointer.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/midi2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ff49d1df79aef7580fe3ac99d17c3f886655d080","lessThan":"49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37","versionType":"git","status":"affected"},{"version":"ff49d1df79aef7580fe3ac99d17c3f886655d080","lessThan":"8a7a33b846d6ba695891b8d0040027cdbad8cd52","versionType":"git","status":"affected"},{"version":"ff49d1df79aef7580fe3ac99d17c3f886655d080","lessThan":"cc014ebf803174f0e5d15956dfc5a38413c945ae","versionType":"git","status":"affected"},{"version":"ff49d1df79aef7580fe3ac99d17c3f886655d080","lessThan":"ae388c0e1bf727972096f770f82d12e4f748d1b6","versionType":"git","status":"affected"},{"version":"ff49d1df79aef7580fe3ac99d17c3f886655d080","lessThan":"4a05b2d1b4642df74f30b6f54843e825c4a2bfd3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/midi2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/49eccef6d6e1c00dac6fb2e7eb6f9206c33e1c37","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a05b2d1b4642df74f30b6f54843e825c4a2bfd3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a7a33b846d6ba695891b8d0040027cdbad8cd52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae388c0e1bf727972096f770f82d12e4f748d1b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc014ebf803174f0e5d15956dfc5a38413c945ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74502","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.197","lastModified":"2026-08-17T06:19:46.693","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ump: fix double free of out_cvts on rawmidi error\n\nsnd_ump_attach_legacy_rawmidi() allocates the legacy conversion array\nump->out_cvts and, on the snd_rawmidi_new() error path, frees it with\nkfree() but leaves ump->out_cvts pointing at the freed memory.  When the\nendpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts\na second time, resulting in a double free.\n\nThe host snd-usb-audio driver attaches the legacy rawmidi for any USB\nMIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail\nreaches this path on enumeration.\n\nClear ump->out_cvts after freeing it on the error path so it is not\nfreed again during teardown.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/ump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"33cd7630782df2230529c3e8f1a6d0ae9cd6ab49","lessThan":"e84d2e53a05c78a04d1343eeb0f31a79456e79fc","versionType":"git","status":"affected"},{"version":"33cd7630782df2230529c3e8f1a6d0ae9cd6ab49","lessThan":"3302aaeac4f7ee6b775850db21d5f61064ce70ad","versionType":"git","status":"affected"},{"version":"33cd7630782df2230529c3e8f1a6d0ae9cd6ab49","lessThan":"032746c2dd9a4ea0774b04ac8a29e2ea628f106e","versionType":"git","status":"affected"},{"version":"33cd7630782df2230529c3e8f1a6d0ae9cd6ab49","lessThan":"c57001f55f97ef856fb6527e376c5c4a056a53a4","versionType":"git","status":"affected"},{"version":"33cd7630782df2230529c3e8f1a6d0ae9cd6ab49","lessThan":"70c977815af0d997feb2d0c5d284d55689bf7051","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/ump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/032746c2dd9a4ea0774b04ac8a29e2ea628f106e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3302aaeac4f7ee6b775850db21d5f61064ce70ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70c977815af0d997feb2d0c5d284d55689bf7051","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c57001f55f97ef856fb6527e376c5c4a056a53a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e84d2e53a05c78a04d1343eeb0f31a79456e79fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74503","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.310","lastModified":"2026-08-17T06:19:46.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes\n\nsnd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD\nand returns early when the flag is already set, but the flag is never\ncleared again.  A completed close ends in remove_slave_links(), which\nleaves timeri->timer NULL, so a second close is already harmless through\nthe timer == NULL path; the early return can only be reached by an\ninstance that was opened again in between.  For such an instance the\nclose unlinks nothing, so snd_timer_instance_free() frees an object that\nis still on timer->open_list_head, still on snd_timer_master_list if it\nwas opened with a slave key, still owns any adopted slaves, and still\nholds its timer and module references.\n\nsnd_seq_timer_open() reopens an instance exactly like that: it retries\nits fallback open on the same object after a failure that has already\nrun snd_timer_close_locked() internally.  An unprivileged user with\naccess to /dev/snd/timer and /dev/snd/seq can force that failure, since\nsnd_timer_check_master() returns -EBUSY when a pending slave matches the\nnew master's (slave_class, slave_id) key and the target timer has\nreached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class =\nSNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a\nsequencer queue's key can be forged.  The freed instance is afterwards\ndereferenced by any further snd_timer_open() on that timer, by\nsnd_timer_check_slave(), and by /proc/asound/timers, which faults on the\nstale ti->owner pointer.\n\nThe flag only has to be visible while the close is in progress, which is\nall its other users need.  Clear it in remove_slave_links(), under the\nsame timer->lock that sets it, once the instance is off every list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"586b219a22b1032b28b8bd356b963276c5e5bf53","lessThan":"bb016091010ec401a06e6bdace0cd944ee03d371","versionType":"git","status":"affected"},{"version":"f46093dd22969037beb1fce2e043f3236be41c92","lessThan":"a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e","versionType":"git","status":"affected"},{"version":"da3039e91d1f835874ed6e9a33ea19ee80c2cb92","lessThan":"0c561fab50991df10b1e4daca25886c34a2a9c07","versionType":"git","status":"affected"},{"version":"da3039e91d1f835874ed6e9a33ea19ee80c2cb92","lessThan":"c2744d5f3aea474513fd2298daecb94a952ce441","versionType":"git","status":"affected"},{"version":"60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f","versionType":"git","status":"affected"},{"version":"6.12.94","lessThan":"6.12.103","versionType":"semver","status":"affected"},{"version":"6.18.36","lessThan":"6.18.44","versionType":"semver","status":"affected"},{"version":"7.0.13","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0c561fab50991df10b1e4daca25886c34a2a9c07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb016091010ec401a06e6bdace0cd944ee03d371","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2744d5f3aea474513fd2298daecb94a952ce441","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74504","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.427","lastModified":"2026-08-17T06:19:46.953","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix division by zero in initialize_timer()\n\nA userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set\nthe backing snd_timer's hardware resolution to an arbitrary 64-bit value\nvia SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.\n\nWhen such a timer is bound to a sequencer queue, initialize_timer()\ncomputes the tick period as\n\n\ttmr->ticks = 1000000000 / (r * freq);\n\nwhere r is that user-controlled resolution and freq is the sequencer\nupdate rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).\nA resolution of 2^63 makes the 64-bit product r * freq wrap to zero for\nany even freq, including DEFAULT_FREQUENCY (1000), so the division faults\nwith a divide-by-zero.\n\nThe division runs under tmr->lock with interrupts disabled, so the oops\nleaves the spinlock held and hangs the CPU. It is reachable by an\nunprivileged user with access to /dev/snd/timer and /dev/snd/seq.\n\n  Oops: divide error: 0000 [#1] SMP KASAN PTI\n  CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+\n  RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0\n   snd_seq_timer_start+0x15e/0x2b0\n   snd_seq_control_queue+0x56f/0xba0\n   snd_seq_write+0x3e0/0x730\n\nReject an overflowing product with check_mul_overflow() and fall back to\na single tick, which also avoids feeding a wrapped-but-nonzero divisor\n(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small\nvalue) into the period computation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/seq/seq_timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"d0e19932875746118e298b4c974f3b2d4aeb16fc","versionType":"git","status":"affected"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"5260e195c53e898a4a76527d4bb2178f31795e78","versionType":"git","status":"affected"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"42c6543ff27ea280334244458d4f52ec7133cc05","versionType":"git","status":"affected"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"21e19688433452dfbbbe6b2bb670dea6eb92f0f6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/seq/seq_timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74505","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.533","lastModified":"2026-08-19T17:21:07.500","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: Fix UAF at error handling during probe\n\nAlthough 6fire driver had a few fixes for dealing with the early error\nhandling during the probe phase, it forgot a pending URB before\nfreeing the resources, which may lead to a UAF.\n\nThis patch addresses it by doing the almost same cleanup procedure\nlike the normal disconnect phase at the error path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/6fire/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"d41bfea14ee6e063a953f6e72046088737c4e66c","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"8b7ecb2446845fa8d1f1ce9aac6307caac50cfd5","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"a0bb5b9d39e54888385dc399c899223299201fe6","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"49bc7741cd2761c703a292dc69245041ae8a67bd","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"2de734dcbb210bd59983e13d36988acbcc122194","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"11e2953d9f4c7c3d2af94a889c2d805c537d633f","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"630c8d6a93cbd9b2a207f1a67ef1fd21af098b0c","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"a54bf16965f896415c3337bc4fbb40fb11941d99","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/6fire/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/11e2953d9f4c7c3d2af94a889c2d805c537d633f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2de734dcbb210bd59983e13d36988acbcc122194","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49bc7741cd2761c703a292dc69245041ae8a67bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/630c8d6a93cbd9b2a207f1a67ef1fd21af098b0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b7ecb2446845fa8d1f1ce9aac6307caac50cfd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0bb5b9d39e54888385dc399c899223299201fe6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a54bf16965f896415c3337bc4fbb40fb11941d99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d41bfea14ee6e063a953f6e72046088737c4e66c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74506","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.630","lastModified":"2026-08-17T06:19:47.137","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix UAF when sending a message\n\nIn afs_make_call(), there's a race with async call reception and\ndestruction.  If a call is dispatched that doesn't have call->write_iter\nset (used to specify the data content for FS.StoreData), then the first\nrxrpc_kernel_send_data() will not set MSG_MORE in the msghdr.\n\nOnce rxrpc_send_data() queues the last request packet, the response could\ncome in at any time and cause the call to be completed and put.  However,\nafs_make_call() will look at the call again to see it ->write_iter should\nbe handled - something it's only allowed to do if it has its own ref on the\ncall.  Whilst this is the case for synchronous calls, it isn't true for\nasync calls such as FS.FetchData.\n\nThere's also a potential UAF in afs_make_call() in the event that an\nasynchronous call is being sent, but the call fails in some way (e.g. it\ngets aborted from the server).  The problem there is that afs_make_call()\ntries to abort a call if the rxrpc send fails, but the asynchronous\nnotification from rxrpc may have caused the afs_call to be torn down.\n\ngeneric/650 plays games with randomly taking CPUs offline, and can\ninterject a significant delay such that the call is deallocated before\nafs_make_call() gets to check call->write_iter - and a UAF ensues (caught\nby KASAN).\n\n   BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs]\n   Read of size 8 at addr ffff888035e050e8 by task fsstress/1409\n\nFix this by making afs_make_op_call() give the op->call its own ref rather\nthan transferring the caller's ref to it and then dropping the ref when\nafs_make_call() returns.\n\nThis also means that the afs_make_call() func never loses its ref on the\ncall now."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/afs/internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2","lessThan":"c0d3b81f703b2a9e37fe1347610a50cdf0078c27","versionType":"git","status":"affected"},{"version":"e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2","lessThan":"daaa726b14fc3026a6b328614d312b698f62f391","versionType":"git","status":"affected"},{"version":"e49c7b2f6de7ff81ca34c56e4eeb4fa740c099f2","lessThan":"4af1ec68d54b3871155914d584fb10669c41a861","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/afs/internal.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4af1ec68d54b3871155914d584fb10669c41a861","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0d3b81f703b2a9e37fe1347610a50cdf0078c27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/daaa726b14fc3026a6b328614d312b698f62f391","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74507","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.733","lastModified":"2026-08-19T17:21:07.643","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: validate numbered report payloads\n\nWhen hidp_get_raw_report() waits for a numbered report,\nhidp_process_data() compares the expected report number with skb->data[0].\nA connected HIDP peer can reply with only a DATA transaction header,\nleaving the skb empty after the header is removed.\n\nKMSAN reports an uninitialized-value use in hidp_session_run(), with the\nvalue originating in __alloc_skb() through vhci_write(). The transaction\nheader checks remove the empty-frame reports, but this report remains until\nthe payload check is added.\n\nThe comparison can also consume a peer-controlled byte beyond the declared\nL2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made\nthe current code accept that byte as report ID 1 and complete\nHIDIOCGFEATURE with a zero-byte result. With this change the malformed\nresponse is rejected with -EIO, while a subsequent valid response still\nsucceeds.\n\nRequire a payload byte before comparing a numbered report ID. Unnumbered\nreports continue to accept an empty payload."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hidp/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"011bf4350d941f1995b2bd4b815ee206cacf2b8e","versionType":"git","status":"affected"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"689d8bb7fee96b7196b572b015b6055c6616ce0c","versionType":"git","status":"affected"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"c73beb320f5705e508bf7d385b8cc5ef8d9c8b69","versionType":"git","status":"affected"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"b7ad105d46acd828e424454815e4cd31069e047a","versionType":"git","status":"affected"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"7e7162427659b70ea17cd41b1f79e2e64c246690","versionType":"git","status":"affected"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"27cc0e603355c585f1e5da8398faa4d36d498188","versionType":"git","status":"affected"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"9c841f59e10b5d75c398a3fc6b2da448d2a2276b","versionType":"git","status":"affected"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"34f53d27b81a16a02828c8fdfa4e02badc326f17","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hidp/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/011bf4350d941f1995b2bd4b815ee206cacf2b8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/27cc0e603355c585f1e5da8398faa4d36d498188","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/34f53d27b81a16a02828c8fdfa4e02badc326f17","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/689d8bb7fee96b7196b572b015b6055c6616ce0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e7162427659b70ea17cd41b1f79e2e64c246690","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c841f59e10b5d75c398a3fc6b2da448d2a2276b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7ad105d46acd828e424454815e4cd31069e047a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c73beb320f5705e508bf7d385b8cc5ef8d9c8b69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74508","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.843","lastModified":"2026-08-23T13:16:44.990","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: reject frames without a transaction header\n\nhidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]\nbefore checking that the L2CAP SDU contains a transaction header. A\nconnected HIDP peer can send an empty basic-mode SDU and make both paths\nuse an uninitialized byte from skb tailroom.\n\nKMSAN reports the use in hidp_session_run(), with the uninitialized value\noriginating in __alloc_skb() through vhci_write(). The control path\nproduces two reports and the interrupt path produces one.\n\nThe byte can also be controlled by a malformed lower-layer packet. If an\nHCI ACL packet contains an L2CAP PDU with a declared zero-length payload\nfollowed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to\nthe declared PDU length before dispatch. The current HIDP path nevertheless\nconsumes the extra byte as HIDP_TRANS_HID_CONTROL |\nHIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this\nchange, the same packet is discarded and a subsequent feature report\nrequest succeeds.\n\nPull the transaction header with skb_pull_data() and discard frames that\ndo not contain it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hidp/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"238c333bc4b3f245c626632e8bfa3c9dab97f51b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"567a2a0a633f2ea5fdccaf3517c09f22c9d860c7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"97b61241ab45bfa5b0526cb0f3978942493bc811","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2ebf63aa557a69990b4e9ea22be224d58aabce96","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"854194494a6f726a60b90b76059148bf08df023d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"47778d2c2087b5d192398f6fddf692d16a5431cf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hidp/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/238c333bc4b3f245c626632e8bfa3c9dab97f51b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/567a2a0a633f2ea5fdccaf3517c09f22c9d860c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74509","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:55.950","lastModified":"2026-08-27T13:18:34.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix advertising data UAFs\n\nhci_find_adv_instance() returns an adv_info pointer that is valid only\nwhile hdev->lock is held.  The advertising command-sync paths perform\ninstance lookups without that lock and, in some cases, retain the pointer\nwhile waiting for a controller response.\n\nAn advertising termination event can therefore interleave as follows:\n\n  hci_cmd_sync_work                 hci_rx_work\n  hci_find_adv_instance()\n  __hci_cmd_sync_status()\n    wait for controller reply       hci_dev_lock()\n                                    hci_remove_adv_instance()\n                                      kfree(adv)\n  adv->scan_rsp_changed = false\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n  Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   hci_set_ext_scan_rsp_data_sync+0x2e1/0x300\n   hci_schedule_adv_instance_sync+0x390/0x4c0\n   hci_cmd_sync_work+0x173/0x300\n  Allocated by task 87:\n   hci_add_adv_instance+0x538/0xac0\n   add_advertising+0x885/0x1160\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   hci_remove_adv_instance+0x1d8/0x3b0\n   hci_le_ext_adv_term_evt+0x17b/0x730\n\nProtect the instance lookup and payload construction in the extended\nadvertising, scan response, and periodic advertising data paths.  Snapshot\nthe advertising parameters under hdev->lock, but release the lock before\nwaiting for the controller.\n\nClear advertising-data dirty bits before issuing their commands and\nrestore them after a failure using a fresh lookup.  Likewise, update the\nreported transmit power through a fresh lookup after the parameter command\ncompletes.  No adv_info pointer then survives an HCI command wait."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cba6b758711cab946c787f7c15be92cc749b8e1f","lessThan":"565971488191bf54a87a417abafab6ad0de72201","versionType":"git","status":"affected"},{"version":"cba6b758711cab946c787f7c15be92cc749b8e1f","lessThan":"c4cec575a6d6f7c36808a3a0017b0675968bb06b","versionType":"git","status":"affected"},{"version":"cba6b758711cab946c787f7c15be92cc749b8e1f","lessThan":"95cdcd8c82a501931fd3ae9b3811b0b6da167e94","versionType":"git","status":"affected"},{"version":"cba6b758711cab946c787f7c15be92cc749b8e1f","lessThan":"eb1d8318764de7216e6dbba29a24d69f7ce51348","versionType":"git","status":"affected"},{"version":"cba6b758711cab946c787f7c15be92cc749b8e1f","lessThan":"b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3","versionType":"git","status":"affected"},{"version":"cba6b758711cab946c787f7c15be92cc749b8e1f","lessThan":"cdc36db204ffd97b947d64374cf23a210dc74777","versionType":"git","status":"affected"},{"version":"42fe380baaaccbe635c34ca07b29d19b9ec2498d","versionType":"git","status":"affected"},{"version":"5.15.210","lessThan":"5.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.154","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/565971488191bf54a87a417abafab6ad0de72201","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95cdcd8c82a501931fd3ae9b3811b0b6da167e94","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b16ebdbebd2d37f4cdc590bc3e9db71fe90350a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4cec575a6d6f7c36808a3a0017b0675968bb06b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdc36db204ffd97b947d64374cf23a210dc74777","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb1d8318764de7216e6dbba29a24d69f7ce51348","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74510","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.063","lastModified":"2026-08-23T13:16:45.310","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix UAF in pair command cancellation\n\nThe pairing completion and authentication failure callbacks look up the\npending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The\nlookup returned a command that was still linked on the shared pending list,\nwithout keeping mgmt_pending_lock held for the later dereference and\nremoval.\n\nA concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the\nsame pending command before the callback uses it. The reverse race is also\npossible when cancel_pair_device() gets a command from pending_find() and a\ncallback removes it before the cancel path dereferences it. This can lead\nto a use-after-free and a second list_del().\n\nMake the pairing lookup helpers transfer ownership of the pending command\nby removing it from hdev->mgmt_pending while holding mgmt_pending_lock.\nThe callbacks and cancel path then complete the command and free it\ndirectly, so racing paths cannot find or free the same command again. Take\na temporary hci_conn reference in cancel_pair_device() because the command\ncompletion drops the reference stored in the pending command."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9a416b5ce0c0f93819f55d34cf6882196e9c3b2","lessThan":"50af4280a587c9971b5388cbc438f1324e626b7b","versionType":"git","status":"affected"},{"version":"e9a416b5ce0c0f93819f55d34cf6882196e9c3b2","lessThan":"86ed4dd6548ccf277bc691bc912ca06e76b9d80c","versionType":"git","status":"affected"},{"version":"e9a416b5ce0c0f93819f55d34cf6882196e9c3b2","lessThan":"7c2a152a897cd1c184b2051484d4f74d803e7f4a","versionType":"git","status":"affected"},{"version":"e9a416b5ce0c0f93819f55d34cf6882196e9c3b2","lessThan":"c569def320aa8b1fde89227e2ea96606790fd86d","versionType":"git","status":"affected"},{"version":"e9a416b5ce0c0f93819f55d34cf6882196e9c3b2","lessThan":"51be7280980fddc90ebe874a69c2fe8ab02bb46a","versionType":"git","status":"affected"},{"version":"e9a416b5ce0c0f93819f55d34cf6882196e9c3b2","lessThan":"d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/50af4280a587c9971b5388cbc438f1324e626b7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74511","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.177","lastModified":"2026-08-19T13:18:10.273","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-74512","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.300","lastModified":"2026-08-19T17:21:07.980","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix potential use-after-free in audit_del_rule()\n\n`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`\nbefore unlinking the rule from RCU-visible filter lists and waiting for a\ngrace period. Concurrent readers in `audit_filter()` and\n`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify\nmark can be freed on an independent lifetime path. This creates a\nuse-after-free window during rule deletion.\n\nFix this by unlinking the rule from the RCU-visible lists and invoking\n`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other\nrule removal helpers). This ensures that all existing RCU readers have\nexited the critical section before any underlying resources are destroyed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/auditfilter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"93616c567469510b7bba55b2674e0c4523fd7e64","versionType":"git","status":"affected"},{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"3f82927b399d7a276c0c12b6ff4424b747a0c9a7","versionType":"git","status":"affected"},{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"8ae135a8962be9d4e8a131eb18eb06cdf02a47ce","versionType":"git","status":"affected"},{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"45bf3df5b32e5a49953e7ceabc55f7dd85380e46","versionType":"git","status":"affected"},{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf","versionType":"git","status":"affected"},{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"cae0dfed5d307b240bff71c3cf206652d1b6f215","versionType":"git","status":"affected"},{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"5b8f46864f06d6dbacb7dcea52bc084dfd122638","versionType":"git","status":"affected"},{"version":"34d99af52ad40bd498ba66970579a5bc1fb1a3bc","lessThan":"246df90b5f1a8a6e6abbd2f058b029558720adec","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/auditfilter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/246df90b5f1a8a6e6abbd2f058b029558720adec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f82927b399d7a276c0c12b6ff4424b747a0c9a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45bf3df5b32e5a49953e7ceabc55f7dd85380e46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b8f46864f06d6dbacb7dcea52bc084dfd122638","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78bde7e9bd36eaae1b8e8cfcd47f12a34f301dbf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ae135a8962be9d4e8a131eb18eb06cdf02a47ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93616c567469510b7bba55b2674e0c4523fd7e64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cae0dfed5d307b240bff71c3cf206652d1b6f215","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74513","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.410","lastModified":"2026-08-17T06:19:48.007","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndibs: fix use-after-free of dmb_node in loopback attach/detach/unregister\n\ndibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()\nlook up the dmb_node under dmb_ht_lock, drop the lock and only then\noperate on the node's refcount. Nothing keeps the node alive across\nthat window: __dibs_lo_unregister_dmb() removes the node from the hash\ntable under the write lock and immediately frees it.\n\nA concurrent final put can therefore free the node between the lookup\nand the refcount operation:\n\nCPU0 (attach)                     CPU1 (owner unregisters)\n\nread_lock_bh(&dmb_ht_lock)\nfind dmb_node (refcnt == 1)\nread_unlock_bh(&dmb_ht_lock)\n                                  refcount_dec_and_test() 1 -> 0\n                                  write_lock_bh(&dmb_ht_lock)\n                                  hash_del(&dmb_node->list)\n                                  write_unlock_bh(&dmb_ht_lock)\n                                  kfree(dmb_node)\nrefcount_inc_not_zero(&dmb_node->refcnt)  <-- use-after-free\n\nThe same window exists for the refcount_dec_and_test() calls in the\ndetach and unregister paths.\n\nClose the race structurally by making hash table membership and the\nrefcount transitions atomic with respect to each other:\n\n- Perform the final refcount_dec_and_test() and hash_del() in a single\n  dmb_ht_lock write-side critical section, in both the unregister and\n  the detach path. Freeing the node still happens after the lock is\n  dropped, which is safe because a node whose refcount reached zero has\n  left the hash table and can no longer be found.\n\n- This establishes the invariant that any node found in the hash table\n  holds at least one reference, and that the final reference can only\n  be dropped under the write lock. dibs_lo_attach_dmb() can thus take\n  its reference with a plain refcount_inc() while still holding the\n  read lock; refcount_inc_not_zero() is no longer needed.\n\n__dibs_lo_unregister_dmb() no longer touches the hash table and is\nrenamed to dibs_lo_free_dmb() accordingly.\n\nNote: commit cc21191b584c (\"dibs: Move data path to dibs layer\") moved\nthe code to its current location; the race was introduced earlier by\ncommit c3a910f2380f (\"net/smc: implement DMB-merged operations of\nloopback-ism\").\n\nTested SMC-D via ISM and dibs loopback."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dibs/dibs_loopback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c3a910f2380fe294d14e42af66af3d3eed8fecbf","lessThan":"c0837aeace96152d14b17fdd19d70102b6631a7d","versionType":"git","status":"affected"},{"version":"c3a910f2380fe294d14e42af66af3d3eed8fecbf","lessThan":"48c073f88c93707089a4214f21cb4c3de5aea6e4","versionType":"git","status":"affected"},{"version":"c3a910f2380fe294d14e42af66af3d3eed8fecbf","lessThan":"a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dibs/dibs_loopback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/48c073f88c93707089a4214f21cb4c3de5aea6e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a10ea943356b9d70c5616a0a06f6fa97cfdaccb1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0837aeace96152d14b17fdd19d70102b6631a7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74514","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.530","lastModified":"2026-08-23T13:16:45.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Fix memory accounting for pinned/unpinned pages\n\nThe account_mem() and unaccount_mem() functions call get_uid() which\nincrements the reference count of struct user_struct on every invocation.\nBut we don't decrement the count by calling free_uid(). It also\naccounted/unaccounted the pages against the current->mm. But its possible\nthe unaccount_mem() can be called from a different process context than the\none that originally pinned the pages.\n\nLet's fix this by storing the pinning process user_struct and mm_struct\nwhen accounting for pinned pages, and subsequently free these resources\nwhen the pages are unpinned.\n\n[borntraeger@linux.ibm.com: Fixed whitespace]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/kvm/pci.c","arch/s390/kvm/pci.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72e","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"dc7465a364104526c56b922c9de9dfcc08a7d5f7","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"47cfd75d9df7c8f425b0d769328fe43a8a8e606e","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"70871b121f81d08879363cb1238a4c85c5c2800c","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"e3f732e086e438c52c7400bd2734bb166aa4752c","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"36f6999ecde3976731a8bfc0b8e667da6f593069","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/kvm/pci.c","arch/s390/kvm/pci.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/36f6999ecde3976731a8bfc0b8e667da6f593069","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47cfd75d9df7c8f425b0d769328fe43a8a8e606e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70871b121f81d08879363cb1238a4c85c5c2800c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc7465a364104526c56b922c9de9dfcc08a7d5f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3f732e086e438c52c7400bd2734bb166aa4752c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74515","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.630","lastModified":"2026-08-19T17:21:08.263","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: Reject adapter interrupt forwarding if already enabled\n\nThe MPCIFC instruction doesn't allow registering adapter interrupts without\nfirst unregistering. So reject any request to enable interrupt forwarding\nif its already enabled for the zPCI device. This also fixes overwriting and\nthus leaking resources when the ioctl is called multiple times for the same\ndevice."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/s390/kvm/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"78d9648e7e960546d5b72504a0b0358cd8bb1e9d","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"6be1ff49ba81f96a6fa55915e6d920be43ac57cc","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"6837f0ae85fd54cf64c8a0c7c530bba2fae0a207","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"591952b63a9f976da7d49f719f36ec826ee2a575","versionType":"git","status":"affected"},{"version":"3c5a1b6f0a18520a0edd0600fef6f1a8553b8fdc","lessThan":"8fa01be5a6149404adb82c0979a78f6347edd3ef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/s390/kvm/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/591952b63a9f976da7d49f719f36ec826ee2a575","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/642d2d1067f7c4d753ae0e3ba5bc98b43cfe3c70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6837f0ae85fd54cf64c8a0c7c530bba2fae0a207","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6be1ff49ba81f96a6fa55915e6d920be43ac57cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78d9648e7e960546d5b72504a0b0358cd8bb1e9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fa01be5a6149404adb82c0979a78f6347edd3ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74516","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.737","lastModified":"2026-08-19T17:21:08.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active\n\nAlways update x2APIC MSR intercepts for L1 when AVIC is deactivated, even\nif L2 is active and KVM is using a separate MSR bitmap to run L2.  If AVIC\nis fully enabled prior to running L2, and is then inhibited while L2 is\nactive (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled,\nbut with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of\nthe host's APIC state, send arbitrary interrupts, change task priority, and\nultimately trivially DoS the host.\n\nE.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with\nCONFIG_HYPERV=n in the host kernel as a \"safe\" PoC, yields:\n\n  Spurious interrupt (vector 0xee) on CPU#425. Acked\n\nAnd hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a\nhandler and WARN on POSTED_INTR_WAKEUP_VECTOR yields:\n\n  ------------[ cut here ]------------\n  WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940\n  CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S   U\n  Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n  Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026\n  RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd]\n  Call Trace:\n   <IRQ>\n   sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80\n   </IRQ>\n   <TASK>\n   asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20\n  RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm]\n   kvm_vcpu_ioctl+0x580/0x6b0 [kvm]\n   __se_sys_ioctl+0x6d/0xb0\n   do_syscall_64+0x10a/0x480\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x46ff4b\n   </TASK>\n  ---[ end trace 0000000000000000 ]---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kvm/svm/avic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"091abbf578f926e763adc0f577baeb7f405b4bdc","lessThan":"4ca05385b3ddbd463be17c6d69ec76fca657081d","versionType":"git","status":"affected"},{"version":"091abbf578f926e763adc0f577baeb7f405b4bdc","lessThan":"6664a5aea45318f4ec156a729949b474dd6e3159","versionType":"git","status":"affected"},{"version":"091abbf578f926e763adc0f577baeb7f405b4bdc","lessThan":"f12373625b4dc9bcc89c41872648878c73bb9272","versionType":"git","status":"affected"},{"version":"091abbf578f926e763adc0f577baeb7f405b4bdc","lessThan":"7668c58dcf465559dc7a0d2e95e9cb79cf47454b","versionType":"git","status":"affected"},{"version":"091abbf578f926e763adc0f577baeb7f405b4bdc","lessThan":"89f9e8398e79c49886766fc24a84c37726231104","versionType":"git","status":"affected"},{"version":"091abbf578f926e763adc0f577baeb7f405b4bdc","lessThan":"7d3aae206663c4e006b25a1c7a20a4029e67da76","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kvm/svm/avic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/4ca05385b3ddbd463be17c6d69ec76fca657081d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6664a5aea45318f4ec156a729949b474dd6e3159","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7668c58dcf465559dc7a0d2e95e9cb79cf47454b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d3aae206663c4e006b25a1c7a20a4029e67da76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89f9e8398e79c49886766fc24a84c37726231104","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f12373625b4dc9bcc89c41872648878c73bb9272","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74517","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.850","lastModified":"2026-08-23T13:16:45.563","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs\n\nCancel (and flush) the I/O APIC's delayed EOI handling work during the\n\"pre VM destroy\" phase, before vCPUs are destroyed, as processing the EOI\nbroadcast will inject another IRQ if the line is asserted, i.e. will try\nto deliver an IRQ to the target vCPU(s).  Canceling the work after vCPUs\nare destroyed leads to UAF if the delayed work is processed after vCPUs are\ndestroyed.\n\n  BUG: KASAN: slab-use-after-free in __kvm_irq_delivery_to_apic_fast+0x9bf/0xa20 arch/x86/kvm/lapic.c:1250\n  Read of size 8 at addr ffff8880499abea0 by task kworker/1:2/1218\n\n  CPU: 1 UID: 0 PID: 1218 Comm: kworker/1:2 Not tainted 7.1.0-rc7 #5 PREEMPT(lazy)\n  Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: events kvm_ioapic_eoi_inject_work\n  Call Trace:\n   <TASK>\n   __dump_stack lib/dump_stack.c:94\n   dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\n   print_address_description mm/kasan/report.c:378\n   print_report+0x139/0x4ad mm/kasan/report.c:482\n   kasan_report+0xe4/0x1d0 mm/kasan/report.c:595\n   __kvm_irq_delivery_to_apic_fast+0x9bf/0xa20 arch/x86/kvm/lapic.c:1250\n   __kvm_irq_delivery_to_apic+0xd8/0xbf0 arch/x86/kvm/lapic.c:1345\n   kvm_irq_delivery_to_apic arch/x86/kvm/lapic.h:129\n   ioapic_service+0x308/0x590 arch/x86/kvm/ioapic.c:492\n   kvm_ioapic_eoi_inject_work+0x13c/0x190 arch/x86/kvm/ioapic.c:532\n   process_one_work+0xa59/0x19a0 kernel/workqueue.c:3314\n   process_scheduled_works kernel/workqueue.c:3397\n   worker_thread+0x5eb/0xe50 kernel/workqueue.c:3478\n   kthread+0x370/0x450 kernel/kthread.c:436\n   ret_from_fork+0x72b/0xd30 arch/x86/kernel/process.c:158\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n   </TASK>\n\nNote, the VM is unreachable once kvm_destroy_vm() starts, and scheduling\nnew work via kvm_ioapic_send_eoi() can only be done via KVM_RUN, i.e.\nrequires a live vCPU.\n\nAlternatively, KVM could simply destroy the I/O APIC during the \"pre\" phase\nof VM destruction, but that gets more than a bit sketchy as KVM expects the\nI/O APIC to exist if ioapic_in_kernel() is true, and nested virtualization\nin particular has a bad habit of touching VM-scope state during vCPU\ndestruction.  E.g. attempting to free the PIC during the pre phase would\nlead to a NULL pointer dereference in kvm_cpu_has_extint(), and it's not\nhard to imagine the I/O APIC having a similar flaw."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/kvm/x86.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c60f5156e62d0be6c53373b623f16a9e37e2208e","lessThan":"69d040448067cebdd5598684db36ce7d8fb2f43e","versionType":"git","status":"affected"},{"version":"17bcd714426386fda741a4bccd96a2870179344b","lessThan":"5f0a99ea721203a4063618aafcca32abf573cb96","versionType":"git","status":"affected"},{"version":"17bcd714426386fda741a4bccd96a2870179344b","lessThan":"ed56a6b58222f9c1f4115a0bd2788dd6ed6022e2","versionType":"git","status":"affected"},{"version":"17bcd714426386fda741a4bccd96a2870179344b","lessThan":"9910e835580fef3bef53b70241dd00c4bffad693","versionType":"git","status":"affected"},{"version":"6.12.41","lessThan":"6.12.105","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/kvm/x86.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.12.105","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.46","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/5f0a99ea721203a4063618aafcca32abf573cb96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69d040448067cebdd5598684db36ce7d8fb2f43e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9910e835580fef3bef53b70241dd00c4bffad693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed56a6b58222f9c1f4115a0bd2788dd6ed6022e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74518","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:56.967","lastModified":"2026-08-19T17:21:08.543","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix list corruption in allocate_file_region_entries()\n\nallocate_file_region_entries() tops up resv->region_cache with freshly\nallocated file_region descriptors.  The allocation uses GFP_KERNEL, so\nresv->lock is dropped around it: the new entries are gathered on a\nstack-local list head, allocated_regions, and spliced into\nresv->region_cache once the lock is re-acquired.\n\nThe splice used list_splice(), which moves the entries but does not\nre-initialize the source head, so allocated_regions is left pointing at an\nentry that now lives on resv->region_cache.  The top-up runs in a while\nloop that re-checks the cache deficit after re-acquiring the lock.  For a\nshared mapping the resv_map is shared by every mapper of the hugetlbfs\ninode, so a concurrent region_chg()/region_add()/region_del() on the same\nresv_map can consume cache entries during the unlocked window and force a\nsecond iteration.  That iteration calls list_add() on the stale head and\ncorrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check\ntrips:\n\n  list_add corruption. next->prev should be prev (ffffc900011ff7f8),\n  but was ffff88814c281460. (next=ffff88814c545640).\n  kernel BUG at lib/list_debug.c:31!\n   allocate_file_region_entries+0x191/0x420\n   region_chg+0x267/0x300\n   hugetlb_reserve_pages+0x387/0xc80\n   hugetlbfs_file_mmap+0x2ce/0x3f0\n   mmap_region+0x1348/0x1a80\n   do_mmap+0x85e/0xb90\n   vm_mmap_pgoff+0x18c/0x330\n   ksys_mmap_pgoff+0x2a1/0x3e0\n   do_syscall_64+0xd7/0x420\n\nWithout CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack\naddress into resv->region_cache, leading to later use-after-free.\n\nThis was observed as a real host panic on a dense KVM host where a QEMU\nguest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate\nSPDK/DPDK vhost-user target, generating concurrent region_* traffic on one\nshared resv_map.\n\nUse list_splice_init() so the source head is re-initialized empty after\neach splice, making the retry loop safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/hugetlb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"01b8569233e47693d6ff7efa96d9854c55f936fc","versionType":"git","status":"affected"},{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"9c5fdffc5e1ce84403c58289ee72697051803bf7","versionType":"git","status":"affected"},{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3","versionType":"git","status":"affected"},{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"62e1c2741a4d923d9854efd5927a6212aad7a187","versionType":"git","status":"affected"},{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"587a0accc2b4fccc5cf7baf0fe34e50efde51f9c","versionType":"git","status":"affected"},{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df","versionType":"git","status":"affected"},{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"ac1bb7fd45088d0db57a22ce7729f258ebd63cf5","versionType":"git","status":"affected"},{"version":"d3ec7b6e09e512ba902b86bcca2c512fb06d492f","lessThan":"dd9623f58ec702a07b2d67179d6fcea79c52231a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/hugetlb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/01b8569233e47693d6ff7efa96d9854c55f936fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/587a0accc2b4fccc5cf7baf0fe34e50efde51f9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62e1c2741a4d923d9854efd5927a6212aad7a187","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c5fdffc5e1ce84403c58289ee72697051803bf7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac1bb7fd45088d0db57a22ce7729f258ebd63cf5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd9623f58ec702a07b2d67179d6fcea79c52231a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74519","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.083","lastModified":"2026-08-19T17:21:08.707","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: devicetree: don't free uninitialized dev_name on error path\n\ndt_remember_or_free_map() duplicates dev_name for each map entry. If\nkstrdup_const() fails, dt_free_map() frees dev_name in all num_maps\nentries, including entries that have not been initialized.\n\nSome pinctrl drivers, including pinctrl-imx, allocate the map with\nkmalloc() and leave dev_name for the core to initialize. The untouched\nentries therefore contain uninitialized data which is passed to\nkfree_const().\n\nReproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection\nwhile binding the pinctrl-consuming device, under KASAN:\n\n  BUG: KASAN: double-free in dt_free_map+0x34/0xa4\n  Free of addr c425a900 by task init/1\n   kfree from dt_free_map+0x34/0xa4\n   dt_free_map from dt_remember_or_free_map+0x184/0x198\n   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8\n   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0\n\nInitialize all dev_name fields to NULL before duplicating the device\nname, making the full-map cleanup safe after a partial failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pinctrl/devicetree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"e3cfb22bad363bebcfd55d909e12d499cb8c5490","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"1586423da2739a80871ef6240016fcb9c7339bfb","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"dec5f0a8080502908dec5e35597c7ae07d533a3b","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"929f6396baade89999ec8a1281232c101cbc727d","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"321fe3584a8298386938130d138191aa35040b75","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"015b5bcbcb622b32317642be91a7f79aa5413649","versionType":"git","status":"affected"},{"version":"03f69244302d7954f42f528ea2d45903ebbf59f3","versionType":"git","status":"affected"},{"version":"77440c3a37203e3f4667d06e37f76ef3968d2d8c","versionType":"git","status":"affected"},{"version":"679c4f27b8958b65bb51d1c3dfdbf3befe4a33a3","versionType":"git","status":"affected"},{"version":"f88ac1330779c5bfdd79f7d7f7d4d3343c782f92","versionType":"git","status":"affected"},{"version":"f739a699db7d5a5cf39ca3ce2c84e4fe4a8f4c5d","versionType":"git","status":"affected"},{"version":"4.4.244","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.244","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.161","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.92","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.7","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pinctrl/devicetree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1586423da2739a80871ef6240016fcb9c7339bfb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dec5f0a8080502908dec5e35597c7ae07d533a3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3cfb22bad363bebcfd55d909e12d499cb8c5490","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74520","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.210","lastModified":"2026-08-17T06:19:48.827","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/iommufd: Fix IOPF group ownership UAF\n\niopf_group_alloc() links each last-page IOPF group into the generic IOPF\npending list before invoking the domain fault handler.\niommufd_fault_iopf_handler() also queued an accepted group in the\nIOMMUFD deliver list without removing it from the generic pending list.\n\nWhen detach or HWPT replacement drops the device's IOPF reference count\nto zero, an IOMMU driver may call iopf_queue_remove_device(). That\nfunction responds to and frees groups through the generic pending list\nwithout removing the same groups from IOMMUFD's deliver list or response\nxarray. A later read, response, or cleanup can then access the freed\ngroup and cause a UAF.\n\nFix this by dequeuing an accepted group from the generic pending list\nbefore IOMMUFD queues it for userspace response.\nMake iopf_group_response() send a response regardless of pending-list\nmembership, so the dequeued group can still be completed by IOMMUFD."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/io-pgfault.c","drivers/iommu/iommufd/eventq.c","include/linux/iommu.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"34765cbc679c59ea5d952d738d2d16bf4aadc497","lessThan":"6da8f37419dd4c456f26fc203f04e000186f4b3d","versionType":"git","status":"affected"},{"version":"34765cbc679c59ea5d952d738d2d16bf4aadc497","lessThan":"4e74a369236424114b94cf6a9f5ff9e848b430b4","versionType":"git","status":"affected"},{"version":"34765cbc679c59ea5d952d738d2d16bf4aadc497","lessThan":"738e6f32e61d80b554e37015ecb7bc620b88001c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/io-pgfault.c","drivers/iommu/iommufd/eventq.c","include/linux/iommu.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/4e74a369236424114b94cf6a9f5ff9e848b430b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6da8f37419dd4c456f26fc203f04e000186f4b3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/738e6f32e61d80b554e37015ecb7bc620b88001c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74521","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.333","lastModified":"2026-08-17T06:19:48.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use memcmp() to compare ClientGUIDs\n\nClientGUID is a fixed-size binary value and can contain embedded NUL\nbytes. strncmp() stops comparing at the first NUL byte, so different\nClientGUID values can incorrectly be treated as equal.\n\nUse memcmp() in SMB3 multichannel session binding and\nFSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE\nbytes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"d535363299822c5caa543787b21bd5cfa3e41949","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"e8bb506e6ef749ac0336f3e579d8d02396b7d832","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/d535363299822c5caa543787b21bd5cfa3e41949","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8bb506e6ef749ac0336f3e579d8d02396b7d832","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74522","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.433","lastModified":"2026-08-19T17:21:08.877","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in __close_file_table_ids()\n\nA ksmbd_file can remain alive after logical close while another session\nholds a temporary reference obtained through ksmbd_lookup_fd_inode().\nksmbd_close_fd() currently marks the file closed and drops the idr-owned\nreference, but leaves the pointer published in the closing session's idr\nuntil the final reference is dropped.\n\nIf the foreign holder performs the final ksmbd_fd_put(), __put_fd_final()\nsupplies the foreign session's file table to __ksmbd_close_fd(). The object\nis then freed without being removed from its owner's idr, and the owner\nsession later dereferences the stale pointer during file-table teardown.\n\nRemove the volatile id from the owner's idr while ksmbd_close_fd() still\nholds that table's lock, and clear volatile_id before dropping\nthe idr-owned reference. A later foreign final put then only performs\nphysical destruction and cannot remove the object from the wrong table."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"19bfd90d5aaf63217735d81964585c5306158e5f","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"9be4a66f019ea90bd9deca70511f4f9ffebf5c6f","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"cffbdc86393b0235383a20c8c59bc32f16036459","versionType":"git","status":"affected"},{"version":"8510a043d334ecdf83d4604782f288db6bf21d60","lessThan":"e7188199eff46a636f3436356f0aae039be6dd66","versionType":"git","status":"affected"},{"version":"df30cbfd3d8a70e61ce59f63ce5ed2261799ac10","versionType":"git","status":"affected"},{"version":"aaf1d5ebb358f546414965b39da90107a7ca7ce5","versionType":"git","status":"affected"},{"version":"5.15.38","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"5.17.6","lessThan":"5.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0c3918c2cee62ec6c9de8d5c73ebfe6f833961ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19bfd90d5aaf63217735d81964585c5306158e5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67aaec2a1fdce3e1dde46c45b5d1ef8cf22f65cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9be4a66f019ea90bd9deca70511f4f9ffebf5c6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cffbdc86393b0235383a20c8c59bc32f16036459","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7188199eff46a636f3436356f0aae039be6dd66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74523","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.543","lastModified":"2026-08-19T17:21:09.017","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nqede: sync udp_tunnel ports outside qede_lock in the recovery path\n\nA TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports\nconfigured wedges the rtnetlink control plane of the whole machine:\n\n  NETDEV WATCHDOG: ens6f1 (qede): transmit queue 2 timed out 10226 ms\n  [qede_tx_timeout:586(ens6f1)]TX timeout on queue 2!\n  [qede_recovery_handler:2665(ens6f0)]Starting a recovery process\n\nThe recovery path deadlocks on the driver's own mutex:\n\n  qede_sp_task\n   rtnl_lock()\n   mutex_lock(&edev->qede_lock)        <- taken\n   qede_recovery_handler\n    qede_load\n    udp_tunnel_nic_reset_ntf\n     __udp_tunnel_nic_device_sync\n      info->sync_table == qede_udp_tunnel_sync\n       mutex_lock(&edev->qede_lock)    <- same task: deadlock\n\nThe mutex is not recursive, so the kworker blocks on itself with\nrtnl_lock held, and neither lock is ever released. Every task that\ncalls rtnl_lock() afterwards (ip, ovs-vswitchd, lldpad, IPv6\naddrconf, sshd) blocks forever while the node still answers ping.\nIn a vmcore from an affected production node rtnl_mutex.owner\ndecodes to the very kworker blocked at the innermost mutex_lock()\nabove.\n\nRe-sync the tunnel ports from qede_sp_task() after the internal lock\nis dropped, still under rtnl_lock as the udp_tunnel API requires.\nThis mirrors qede_open(), which calls udp_tunnel_nic_reset_ntf()\nunder rtnl without the internal lock.\n\nqede_recovery_handler() now returns whether it has successfully\nreloaded an open device, and the caller re-syncs the ports only in\nthat case. This keeps the old gating exactly: a device that was down\nor a failed recovery returns false, as those paths never reached the\nudp_tunnel_nic_reset_ntf() call before either.\n\nThis was the only user of the qede_lock()/qede_unlock() helpers, so\nremove them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/qlogic/qede/qede_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"19e505ee8bb9e0f0355eda9e9f614fb25fed0070","versionType":"git","status":"affected"},{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"c4c1e5d6bc2b900b2328d6fff93dc8146b858d69","versionType":"git","status":"affected"},{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"8e1bdf57de91247e57816482966265ada573cc74","versionType":"git","status":"affected"},{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"e382a4efeeae6555b95d9ff336cf3094ee7d336b","versionType":"git","status":"affected"},{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"4626df3f63c9185efba5750fe76ac01ab3351bae","versionType":"git","status":"affected"},{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"e51becb8f3377a377171ed5bf0082b96e22e6292","versionType":"git","status":"affected"},{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"6f1ef8170d3d8ad9319aa01347945dcdf5cc4f27","versionType":"git","status":"affected"},{"version":"8cd160a29415f1789d473b1dc07fcc9d02a02b87","lessThan":"451c9075d6c53f2438d110addbeeeea6fac18567","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/qlogic/qede/qede_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/19e505ee8bb9e0f0355eda9e9f614fb25fed0070","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/451c9075d6c53f2438d110addbeeeea6fac18567","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4626df3f63c9185efba5750fe76ac01ab3351bae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f1ef8170d3d8ad9319aa01347945dcdf5cc4f27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e1bdf57de91247e57816482966265ada573cc74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4c1e5d6bc2b900b2328d6fff93dc8146b858d69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e382a4efeeae6555b95d9ff336cf3094ee7d336b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e51becb8f3377a377171ed5bf0082b96e22e6292","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74524","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.660","lastModified":"2026-08-17T06:19:49.290","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: mm: Fix out-of-bounds page-table walk during memory hot-remove\n\nremove_pud_mapping() and remove_p4d_mapping() obtain a child table base\nwith pud_offset(p4dp, 0) and p4d_offset(pgd, 0), then add the index for\naddr.\n\nRISC-V folds page-table levels at runtime. When a level is folded, its\noffset helper returns the parent entry itself, but the index can still be\nnonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39\nfolds both P4D and PUD, so memory hot-remove can descend into unrelated\nmemory and pass an invalid page to __free_pages(). This can trigger:\n\n  kernel BUG at include/linux/mm.h:1810!\n  VM_BUG_ON_PAGE(page_ref_count(page) == 0)\n  arch_remove_memory+0x1e/0x5c\n  try_remove_memory+0x15e/0x200\n  remove_memory+0x24/0x3c\n\nOnly add the index when the corresponding page-table level is enabled,\nmatching p4d_offset() and pud_offset()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/riscv/mm/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c75a74f4ba19c904c0ae1e011ae2568449409ae4","lessThan":"1da6d832eda02d908df11a30ba6a856b98a3dd76","versionType":"git","status":"affected"},{"version":"c75a74f4ba19c904c0ae1e011ae2568449409ae4","lessThan":"54e07a158f7aea2754849d3a5a4cba1ac338ae7e","versionType":"git","status":"affected"},{"version":"c75a74f4ba19c904c0ae1e011ae2568449409ae4","lessThan":"1bb0ef8069ef158d245bac91ac178bb4f1a7ccd2","versionType":"git","status":"affected"},{"version":"c75a74f4ba19c904c0ae1e011ae2568449409ae4","lessThan":"a0188cc133696627857d16054e43f9ebc7efc821","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/riscv/mm/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1bb0ef8069ef158d245bac91ac178bb4f1a7ccd2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1da6d832eda02d908df11a30ba6a856b98a3dd76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54e07a158f7aea2754849d3a5a4cba1ac338ae7e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0188cc133696627857d16054e43f9ebc7efc821","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74525","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.763","lastModified":"2026-08-19T17:21:09.177","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sxgbe: free TX rings on RX allocation failure\n\nWhen RX descriptor ring allocation fails, init_dma_desc_rings() only\nfrees the partially allocated RX rings and returns. The TX rings that\nwere allocated earlier in the same function are leaked.\n\nRearrange error labels to clean up TX rings upon RX failures."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"923389d0370b4117bd579784442e8450f9bb89be","versionType":"git","status":"affected"},{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"a07a69f472fff1c6edf77ca97616381657a8444c","versionType":"git","status":"affected"},{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"f52de3ea462229457334c9d3c0d95a7856908664","versionType":"git","status":"affected"},{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"3563e2486dcd50a751dbcbc1de37e5186646dce6","versionType":"git","status":"affected"},{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"b33644a4f6d8f127c62d7b39f24114d3d2499204","versionType":"git","status":"affected"},{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"42b87cfd9666ef156637c90ff3f6f6dd9a5ad4cb","versionType":"git","status":"affected"},{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"f2e5bb9fb710553e76a3be9097b448b4e73d8c92","versionType":"git","status":"affected"},{"version":"1edb9ca69e8a7988900fc0283e10550b5592164d","lessThan":"c870f7e2890b9f78ac84515a9809cc5c183c975e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3563e2486dcd50a751dbcbc1de37e5186646dce6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42b87cfd9666ef156637c90ff3f6f6dd9a5ad4cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/923389d0370b4117bd579784442e8450f9bb89be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a07a69f472fff1c6edf77ca97616381657a8444c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b33644a4f6d8f127c62d7b39f24114d3d2499204","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c870f7e2890b9f78ac84515a9809cc5c183c975e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2e5bb9fb710553e76a3be9097b448b4e73d8c92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f52de3ea462229457334c9d3c0d95a7856908664","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74526","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.883","lastModified":"2026-08-17T06:19:49.460","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit\n\nmpi3mr_fault_uevent_emit() runs from the fault watchdog and reset paths\nwhere host I/O may already be blocked. GFP_KERNEL allocations here, both\nthe local kzalloc_obj() and the ones inside kobject_uevent_env() itself,\ncan trigger reclaim that waits on that blocked I/O and deadlock.\n\nUse memalloc_noio_save()/restore() to cover the whole call instead of\njust the local allocation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/mpi3mr/mpi3mr_fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec54b348f274fdd2bd32bbe74de6d62ae1a10a18","lessThan":"df817b19dac7034416d18f14347010b3e9f5cf3d","versionType":"git","status":"affected"},{"version":"ec54b348f274fdd2bd32bbe74de6d62ae1a10a18","lessThan":"ccff8c92571500fcfed21281e33daaf645bf692f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/mpi3mr/mpi3mr_fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/ccff8c92571500fcfed21281e33daaf645bf692f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df817b19dac7034416d18f14347010b3e9f5cf3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74527","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:57.983","lastModified":"2026-08-17T06:19:49.550","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Block VFs from clobbering special CGX PKIND state\n\nPF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND\nprogramming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must\nnot reset the LMAC RX PKIND or default TX parse config over the PF setup.\n\nAdd cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip\ncgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates\nwhen the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/cgx.c","drivers/net/ethernet/marvell/octeontx2/af/cgx.h","drivers/net/ethernet/marvell/octeontx2/af/rvu.h","drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c","drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c","drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"94d942c5fb970ac2166216838b278613decfa9a0","lessThan":"d3c6b0f48f126a36955b3fb4154a59d0b3621d97","versionType":"git","status":"affected"},{"version":"94d942c5fb970ac2166216838b278613decfa9a0","lessThan":"3bd438a58e910db5dc369aa25dfed1fc95f1b596","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/cgx.c","drivers/net/ethernet/marvell/octeontx2/af/cgx.h","drivers/net/ethernet/marvell/octeontx2/af/rvu.h","drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c","drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c","drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/3bd438a58e910db5dc369aa25dfed1fc95f1b596","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3c6b0f48f126a36955b3fb4154a59d0b3621d97","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74528","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.083","lastModified":"2026-08-17T06:19:49.660","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_past_sync() callback\n\nAvoids giving freed pointers to hci_conn_valid(), which kmalloc may have\nreused.\n\nHold refcount to avoid that."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d3413703d5f8b7d1e6f514f9440ed5da1bc30796","lessThan":"e6792adef614b389141b142e30ee549e4a47dd7d","versionType":"git","status":"affected"},{"version":"d3413703d5f8b7d1e6f514f9440ed5da1bc30796","lessThan":"abf9753edf3f88282c44a605f3945d8d4f8dd86c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/abf9753edf3f88282c44a605f3945d8d4f8dd86c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6792adef614b389141b142e30ee549e4a47dd7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74529","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.190","lastModified":"2026-08-17T06:19:49.770","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6d0417e4e1cf66fd917f06f0454958362714ef7d","lessThan":"c53c70ec289ee12f20c4f1b2fbfd151762c01f67","versionType":"git","status":"affected"},{"version":"6d0417e4e1cf66fd917f06f0454958362714ef7d","lessThan":"44fc74069d8988f2825246f9401218e29de2c0ab","versionType":"git","status":"affected"},{"version":"eb8b860e87b296bd1874c79a668081efd00f9754","versionType":"git","status":"affected"},{"version":"94bf6380e936339a700c0b3171a49baf512aa70b","versionType":"git","status":"affected"},{"version":"6.12.28","lessThan":"6.13","versionType":"semver","status":"affected"},{"version":"6.14.6","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/44fc74069d8988f2825246f9401218e29de2c0ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c53c70ec289ee12f20c4f1b2fbfd151762c01f67","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74530","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.297","lastModified":"2026-08-17T06:19:49.880","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold conn in hci_connect_big_sync() callback\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to\nmatch the previous behavior."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"024421cf39923927ab2b5fe895d1d922b9abe67f","lessThan":"2d91e6244b69d752503b2d44020d8b0e323dbd38","versionType":"git","status":"affected"},{"version":"024421cf39923927ab2b5fe895d1d922b9abe67f","lessThan":"56e78b670356caab0b607e8aad4cf819a1909d07","versionType":"git","status":"affected"},{"version":"620810ac1f7f1133a9ac403e132b3ad6995ddf39","versionType":"git","status":"affected"},{"version":"ee0586ad64a805eaf1a9a10100e908627a561e34","versionType":"git","status":"affected"},{"version":"6.12.28","lessThan":"6.13","versionType":"semver","status":"affected"},{"version":"6.14.6","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2d91e6244b69d752503b2d44020d8b0e323dbd38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56e78b670356caab0b607e8aad4cf819a1909d07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74531","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.397","lastModified":"2026-08-23T13:16:45.710","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: hold conn reference in abort_conn_sync()\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_conn.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"249c88e7fb45b6b705040c5af4bd0d0f2bc9735c","lessThan":"64d1645f26aa49b5a86ba2fccd0bb6749ea725a6","versionType":"git","status":"affected"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"963fb4b8e7d1ab07b4ae45bf15d41e667c88caca","versionType":"git","status":"affected"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"e8f9fef362bab431d95371d3406bc720350290c3","versionType":"git","status":"affected"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"fa812cfa81aa3d4a7b6ce8277979af57b3f79712","versionType":"git","status":"affected"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"5761d003daa987ac81463f570713ce9c9dd204e5","versionType":"git","status":"affected"},{"version":"7fe4d391e937c2f048a43ff4b421e677f10d83c0","versionType":"git","status":"affected"},{"version":"58afdc9b18871eb1d461c725be9e9f3f44a39aeb","versionType":"git","status":"affected"},{"version":"6.6.51","lessThan":"6.6.151","versionType":"semver","status":"affected"},{"version":"6.1.184","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.10.10","lessThan":"6.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_conn.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64d1645f26aa49b5a86ba2fccd0bb6749ea725a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/963fb4b8e7d1ab07b4ae45bf15d41e667c88caca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8f9fef362bab431d95371d3406bc720350290c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa812cfa81aa3d4a7b6ce8277979af57b3f79712","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74532","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.500","lastModified":"2026-08-17T06:19:50.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: Validate length before parsing diagnostics TLV\n\nbtintel_diagnostics() accesses tlv->val[0] without first validating\nthat the diagnostics VSE is long enough to contain that field, so\nmay cause reading data beyond the received frame.\n\nFix by validating the length before access."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"af395330abed142a2685bf3d17a938544816bf3c","lessThan":"c31be902ccbbb0b2c23159a1481dce80d1f9753d","versionType":"git","status":"affected"},{"version":"af395330abed142a2685bf3d17a938544816bf3c","lessThan":"dd20e30bdbd707ea8ced581f3d7f9e9854634b17","versionType":"git","status":"affected"},{"version":"af395330abed142a2685bf3d17a938544816bf3c","lessThan":"c618a9a5b08ea2e17bddf4e948be9f75d408fca4","versionType":"git","status":"affected"},{"version":"af395330abed142a2685bf3d17a938544816bf3c","lessThan":"6ec9c3dc52302b891513f608f5fb478349b15ab3","versionType":"git","status":"affected"},{"version":"af395330abed142a2685bf3d17a938544816bf3c","lessThan":"b640ff9af3c809ff5ea2077fbba17df1594ec1e4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6ec9c3dc52302b891513f608f5fb478349b15ab3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b640ff9af3c809ff5ea2077fbba17df1594ec1e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c31be902ccbbb0b2c23159a1481dce80d1f9753d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c618a9a5b08ea2e17bddf4e948be9f75d408fca4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd20e30bdbd707ea8ced581f3d7f9e9854634b17","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74533","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.603","lastModified":"2026-08-17T06:19:50.230","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix race of kfree vs kref_get_unless_zero\n\nhci_conn::iso_data is accessed and modified without lock or RCU.\nThis leads to a race\n\n    [Task hdev->workqueue]                 \t[Task 2]\n    iso_recv                                    iso_conn_put(conn)\n      conn = LOAD hcon->iso_data                  iso_conn_free(conn)\n      iso_conn_hold_unless_zero(conn)               hcon->iso_data = NULL\n                                                    kfree(conn)\n        kref_get_unless_zero(&conn->ref) /* UAF */\n\nand also to races in iso_conn_add() vs. iso_conn_free().\n\nFix by adding spinlock hci_conn::proto_lock and using it to guard\nhci_conn::iso_data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/bluetooth/hci_core.h","net/bluetooth/hci_conn.c","net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"876a3e94c70d0859d1dad1c986112d4f0d99eba8","versionType":"git","status":"affected"},{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","versionType":"git","status":"affected"},{"version":"f53e7489273dc2bb307bf50f319b3762d45534f0","versionType":"git","status":"affected"},{"version":"a58d0f5dac322e16cc75334d000666512341bde5","versionType":"git","status":"affected"},{"version":"6.11.11","lessThan":"6.12","versionType":"semver","status":"affected"},{"version":"6.12.2","lessThan":"6.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/bluetooth/hci_core.h","net/bluetooth/hci_conn.c","net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/876a3e94c70d0859d1dad1c986112d4f0d99eba8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74534","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.700","lastModified":"2026-08-17T06:19:50.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix refcounting of iso_conn\n\niso_conn_del() and iso_chan_del() have a race that results to double-put\nof iso_conn:\n\n    [Task hdev->workqueue]         [Task 2]\n    iso_conn_del                   iso_chan_del\n      iso_conn_hold_unless_zero      iso_conn_lock\n      iso_conn_lock                  conn->sk = NULL\n                                     iso_conn_unlock\n      sk = iso_sock_hold(conn)  <---------´\n      if (!sk) iso_conn_put          iso_conn_put\n      iso_conn_put /* UAF */\n\nThe extra put for !sk in iso_conn_del() is currently required since\nfailing iso_chan_add() may leave iso_conn not associated with any sk.\n\nFix by having iso_pi(sk)->conn own refcount when non-NULL, so\niso_conn_del does not need to put it.  Adjust the iso_conn_add()\nrefcounting so that conn is put if it does not get associated with an\nsk."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"3b921533e8aa95b77aadcf31737595578e735f3c","versionType":"git","status":"affected"},{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"8208b4939afb0a1977fffe902c3ca42fe0f3baaa","versionType":"git","status":"affected"},{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"fdfde532ab1caa165fcd8985001157ac8b4db365","versionType":"git","status":"affected"},{"version":"f53e7489273dc2bb307bf50f319b3762d45534f0","versionType":"git","status":"affected"},{"version":"a58d0f5dac322e16cc75334d000666512341bde5","versionType":"git","status":"affected"},{"version":"6.11.11","lessThan":"6.12","versionType":"semver","status":"affected"},{"version":"6.12.2","lessThan":"6.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3b921533e8aa95b77aadcf31737595578e735f3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8208b4939afb0a1977fffe902c3ca42fe0f3baaa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdfde532ab1caa165fcd8985001157ac8b4db365","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74535","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.837","lastModified":"2026-08-17T06:19:50.587","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: avoid deadlocks in iso_sock_timeout\n\niso_sock_timeout() takes lock_sock, so sync disabling the timer while\nholding that lock may deadlock.\n\niso_sock_timeout() may also run concurrently with iso_conn_del(), which\nleads to UAF\n\n        [Task 1]                      [Task hdev->workqueue]\n        iso_sock_timeout              iso_conn_del\n          iso_conn_hold_unless_zero     iso_chan_del\n                           `------------> iso_conn_put\n                                      caller frees hcon\n          iso_conn_put\n            iso_conn_free\n              conn->hcon->iso_data = NULL; /* UAF */\n\nFix the deadlock by removing the disable from the lock_sock sections.\nMove the timer from iso_conn to iso_pinfo to decouple it from iso_conn\nwhich may need to be freed in lock_sock section. Convert some of the\nclear_timer to disable_timer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a58d0f5dac322e16cc75334d000666512341bde5","lessThan":"16d89a63e08280abeef7218970a3bbd7ca62b021","versionType":"git","status":"affected"},{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"82e982f54f962f72646868ddbb2c3bd9ea178568","versionType":"git","status":"affected"},{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"3c3d5f85db80145636bb991a6005e2760012b985","versionType":"git","status":"affected"},{"version":"dc26097bdb864a0d5955b9a25e43376ffc1af99b","lessThan":"200fa1629c57a3ca2b03d3ca63fd3a9bfd910c43","versionType":"git","status":"affected"},{"version":"f53e7489273dc2bb307bf50f319b3762d45534f0","versionType":"git","status":"affected"},{"version":"6.12.2","lessThan":"6.12.103","versionType":"semver","status":"affected"},{"version":"6.11.11","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/16d89a63e08280abeef7218970a3bbd7ca62b021","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/200fa1629c57a3ca2b03d3ca63fd3a9bfd910c43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c3d5f85db80145636bb991a6005e2760012b985","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82e982f54f962f72646868ddbb2c3bd9ea178568","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74536","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:58.940","lastModified":"2026-08-17T06:19:50.720","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: fix leaking sk after socket release\n\niso_sock_kill() tests !sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||\nsock_flag(sk, SOCK_DEAD) for early return, but this is always true since\nsock_orphan(sk) sets SOCK_DEAD, so the sk reference released by socket\nalways leaks, iso_sock_destruct is never called.\n\nThe socket reference also leaks when __iso_sock_close() does not set\nSOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after\nzapping.\n\nFix by replacing SOCK_DEAD by BT_SK_KILLED flag that is not used for\nsomething else, and lock_sock to ensure iso_sock_kill() puts sk only\nafter socket release only once. Release and iso_conn_del may run\nconcurrently. Call iso_sock_kill() from iso_conn_del() to clean sk up\nafter zapping.\n\nRemove call to iso_sock_kill() from iso_sock_close(), as it's generally\nno-op there."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"96ed3c772c08e7a91c399567f412618e43231023","versionType":"git","status":"affected"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"e76a0ae6542ae43241b2147bacf4990e7ae5316a","versionType":"git","status":"affected"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"e30e5ca63c8fbe3cd505fbb419bb547760cda633","versionType":"git","status":"affected"},{"version":"ccf74f2390d60a2f9a75ef496d2564abb478f46a","lessThan":"ce57442a379212fe3fda59c9437ee8217eceb5b1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/96ed3c772c08e7a91c399567f412618e43231023","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce57442a379212fe3fda59c9437ee8217eceb5b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e30e5ca63c8fbe3cd505fbb419bb547760cda633","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e76a0ae6542ae43241b2147bacf4990e7ae5316a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74537","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.040","lastModified":"2026-08-17T06:19:50.807","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: hold sk properly in iso_conn_ready\n\nsk deref in iso_conn_ready must be done either under conn->lock, or\nholding a refcount, to avoid concurrent close. conn->sk is currently\naccessed without either:\n\n    [Task 1]            [Task 2]\n                        iso_sock_release\n    iso_conn_ready\n      sk = conn->sk\n                          lock_sock(sk)\n                            conn->sk = NULL\n      lock_sock(sk)\n                          release_sock(sk)\n                          iso_sock_kill(sk)\n       UAF on sk deref\n\nFix possible UAF by holding sk refcount in iso_conn_ready().  Also\nrecheck after lock_sock that the socket is still valid.  Adjust locking\nso conn->sk is cleared only under lock_sock."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"27c24fda62b601d6f9ca5e992502578c4310876f","lessThan":"4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5","versionType":"git","status":"affected"},{"version":"27c24fda62b601d6f9ca5e992502578c4310876f","lessThan":"1308d72903d792d10b82bc4ef08b8a4452308b04","versionType":"git","status":"affected"},{"version":"27c24fda62b601d6f9ca5e992502578c4310876f","lessThan":"0d255e63fcf3f13a570d7ac11678fa1164ac015c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74538","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.137","lastModified":"2026-08-17T06:19:50.917","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_connect_ind\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not taken in the\n\"ev3\" part of iso_connect_ind.  It may also be NULL if socket has\ntransitioned away from the LISTEN/CONNECT states before locking.\n\nFix by adding lock/release. Recheck hcon is valid after lock acquire\nwhere needed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"168d9bf9c7f01df71e6404cfff66d9c2a8e968fb","lessThan":"e8e9cff6d80eeec28dec4cf7cc18662986945391","versionType":"git","status":"affected"},{"version":"168d9bf9c7f01df71e6404cfff66d9c2a8e968fb","lessThan":"9bee7e476534f27e830658dad962d85da9edf6bf","versionType":"git","status":"affected"},{"version":"168d9bf9c7f01df71e6404cfff66d9c2a8e968fb","lessThan":"4311fd6f429065a8ba208660360a895627a00cf3","versionType":"git","status":"affected"},{"version":"489efc9ae36f164423f5fa7ace772a7ab8131cd8","versionType":"git","status":"affected"},{"version":"6.8.9","lessThan":"6.9","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4311fd6f429065a8ba208660360a895627a00cf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bee7e476534f27e830658dad962d85da9edf6bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8e9cff6d80eeec28dec4cf7cc18662986945391","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74539","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.233","lastModified":"2026-08-17T06:19:51.040","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_sock_getname\n\nAccessing iso_pi(sk)->conn requires lock_sock, which is not held here.\n\nFix by adding the lock/release."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","lessThan":"72d5bb1d77d7c3330146dc0cfd43f704c64b9594","versionType":"git","status":"affected"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","lessThan":"202670e6602e068558c1fca2df40719ee91a2906","versionType":"git","status":"affected"},{"version":"2df108c227b266a9ec9e3fda3828d2ac9662aa33","lessThan":"89cf154d7c18e6e94a3da83051f3cf2bac317ae2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/202670e6602e068558c1fca2df40719ee91a2906","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72d5bb1d77d7c3330146dc0cfd43f704c64b9594","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89cf154d7c18e6e94a3da83051f3cf2bac317ae2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74540","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.337","lastModified":"2026-08-19T17:21:09.300","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp\n\nl2cap_le_connect_rsp() obtains a channel via\n__l2cap_get_chan_by_ident() but neither holds a reference nor uses\nl2cap_chan_hold_unless_zero() before locking and operating on it.\nA concurrent l2cap_chan_del() triggered by a remote disconnect can\nfree the channel between the lookup and l2cap_chan_lock(), causing\na use-after-free.\n\nThe BR/EDR counterpart l2cap_connect_rsp() and the sibling handler\nl2cap_le_command_rej() already use l2cap_chan_hold_unless_zero()\nto safely hold a reference, but l2cap_le_connect_rsp() was left\nunprotected.\n\nFix by adding l2cap_chan_hold_unless_zero() after the ident lookup\nand l2cap_chan_put() on the exit path, consistent with other L2CAP\nresponse handlers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"15d6c2367217a6a20b1abae9f38ded716bf620f1","versionType":"git","status":"affected"},{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"1818180fe12d6cec7a437bc59cde8efdf6b10250","versionType":"git","status":"affected"},{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"8325eafb38c3dee5af329266393763693d17381b","versionType":"git","status":"affected"},{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"fd4c1e301bdec60a40728ea37de531cbccda501a","versionType":"git","status":"affected"},{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"522b730c62c53a1981604fd73524697fd347830d","versionType":"git","status":"affected"},{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136","versionType":"git","status":"affected"},{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"09f447accc2570751e7d17f0dc0788b40d3edade","versionType":"git","status":"affected"},{"version":"f1496dee9cbde2a62821f4441dadb0d3360f60c3","lessThan":"c4740e7f23ff9a8210198d8b4703259e21b9f69d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.14","status":"affected"},{"version":"0","lessThan":"3.14","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/09f447accc2570751e7d17f0dc0788b40d3edade","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/15d6c2367217a6a20b1abae9f38ded716bf620f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1818180fe12d6cec7a437bc59cde8efdf6b10250","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/522b730c62c53a1981604fd73524697fd347830d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/58e3c5289ad230a7e24ae4b0c7b43f5ee6e32136","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8325eafb38c3dee5af329266393763693d17381b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4740e7f23ff9a8210198d8b4703259e21b9f69d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd4c1e301bdec60a40728ea37de531cbccda501a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74541","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.443","lastModified":"2026-08-17T06:19:51.297","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: clear iso_data always when detaching conn from hcon\n\nWhen setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is\nnecessary, otherwise later iso_conn_free() will UAF.\n\nFix clearing of iso_data in iso_sock_disconn()\n\nFixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on\niso_sock_release() followed by hci_abort_conn_sync()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fbdc4bc47268953c80853489f696e02d61f9a2c6","lessThan":"cc1d39946d62bc568551dfb81149724de1e91338","versionType":"git","status":"affected"},{"version":"fbdc4bc47268953c80853489f696e02d61f9a2c6","lessThan":"7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0","versionType":"git","status":"affected"},{"version":"fbdc4bc47268953c80853489f696e02d61f9a2c6","lessThan":"63c0f396a18b767eb28e895eb95bbdce6c172c59","versionType":"git","status":"affected"},{"version":"fbdc4bc47268953c80853489f696e02d61f9a2c6","lessThan":"69a4a7b162b3db6ac337e3094cdee38f24d42ff7","versionType":"git","status":"affected"},{"version":"fbdc4bc47268953c80853489f696e02d61f9a2c6","lessThan":"d57e506f6a1e3929611340fae87c1e4823f4d85c","versionType":"git","status":"affected"},{"version":"c03a10bd5b6ccb22921e04bcddc987410df7e7a9","versionType":"git","status":"affected"},{"version":"6.5.12","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/63c0f396a18b767eb28e895eb95bbdce6c172c59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69a4a7b162b3db6ac337e3094cdee38f24d42ff7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b51a9c25e9698b64df9f2218f10eecf7dc7e2d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc1d39946d62bc568551dfb81149724de1e91338","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d57e506f6a1e3929611340fae87c1e4823f4d85c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74542","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.543","lastModified":"2026-08-17T06:19:51.413","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix folio_queue ENOMEM in writeback by adding a mempool\n\nFix the handling of folio_queue allocation failure in writeback by adding a\nmempool and passing in gfp_t flags to the rolling buffer functions that\nallocate memory, using the mempool if gfp != GFP_KERNEL.\n\nThis is then extended upwards and the gfp to be used for a request is stored\nin the netfs_io_request struct and is then used for both requests and\nsubrequests, eliminating the sleeping loops there.\n\nThe failure caused:\n\n    folio != NULL\n    WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/netfs/buffered_read.c","fs/netfs/internal.h","fs/netfs/main.c","fs/netfs/objects.c","fs/netfs/read_pgpriv2.c","fs/netfs/rolling_buffer.c","fs/netfs/write_issue.c","include/linux/netfs.h","include/linux/rolling_buffer.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cd0277ed0c188dd40e7744e89299af7b78831ca4","lessThan":"3f6d7f8a5416d852648d15a05e895f1195ee8a85","versionType":"git","status":"affected"},{"version":"cd0277ed0c188dd40e7744e89299af7b78831ca4","lessThan":"1d78d56c43ef3768183e8370e7367b162700e049","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/netfs/buffered_read.c","fs/netfs/internal.h","fs/netfs/main.c","fs/netfs/objects.c","fs/netfs/read_pgpriv2.c","fs/netfs/rolling_buffer.c","fs/netfs/write_issue.c","include/linux/netfs.h","include/linux/rolling_buffer.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1d78d56c43ef3768183e8370e7367b162700e049","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f6d7f8a5416d852648d15a05e895f1195ee8a85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74543","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.643","lastModified":"2026-08-17T06:19:51.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()\n\nsyzbot reported a memory leak [1] in the UDP tunnel NIC offload code.\n\nWhen device registration fails (e.g. in register_netdevice()), netdev core\nunwinds by sending a single NETDEV_UNREGISTER notification. If work was queued\nduring NETDEV_REGISTER (utn->work_pending is set), udp_tunnel_nic_unregister()\nreturns early:\n\n\tif (utn->work_pending)\n\t\treturn;\n\nBecause failed registrations do not enter netdev_wait_allrefs_any(), no\nsubsequent NETDEV_UNREGISTER rebroadcast will ever occur. As a result, the\nstruct udp_tunnel_nic allocated in udp_tunnel_nic_alloc() is leaked\npermanently.\n\nFix this by removing the early return. Instead, synchronously cancel any\npending work with cancel_delayed_work_sync() before freeing @utn.\n\nTo be able to call cancel_delayed_work_sync() while holding RTNL (the work also\nneeds RTNL), switch udp_tunnel_nic_device_sync_work() to rtnl_trylock(). If RTNL\nis contended, requeue the work with a 1 jiffy delay (via queue_delayed_work())\nto prevent high CPU contention while waiting for RTNL lock.\n\nThe utn->work_pending bookkeeping is no longer needed and is removed, as\nthe workqueue core already tracks the pending/running state of the work.\n\n[1]\nBUG: memory leak\nunreferenced object 0xffff888127d5f840 (size 96):\n  comm \"syz-executor\", pid 5806, jiffies 4294942188\n  backtrace (crc 99fdb6c8):\n    __kmalloc_noprof+0x3bf/0x550\n    udp_tunnel_nic_alloc net/ipv4/udp_tunnel_nic.c:756 [inline]\n    udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:833 [inline]\n    udp_tunnel_nic_netdevice_event+0x804/0xab0 net/ipv4/udp_tunnel_nic.c:931\n    notifier_call_chain+0x59/0x160 kernel/notifier.c:85\n    call_netdevice_notifiers_info+0x7d/0xb0 net/core/dev.c:2250\n    register_netdevice+0xc10/0xeb0 net/core/dev.c:11478"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/udp_tunnel_nic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cc4e3835eff474aa274d6e1d18f69d9d296d3b76","lessThan":"b712da45bd9b9835d132e9fbc0c3e43c164cb1fd","versionType":"git","status":"affected"},{"version":"cc4e3835eff474aa274d6e1d18f69d9d296d3b76","lessThan":"f82a2ded3d7a9098267c84f14eafdb98c4550ac5","versionType":"git","status":"affected"},{"version":"cc4e3835eff474aa274d6e1d18f69d9d296d3b76","lessThan":"b322532a4b774db1b480a2de84125910a70739a5","versionType":"git","status":"affected"},{"version":"cc4e3835eff474aa274d6e1d18f69d9d296d3b76","lessThan":"080695e6f005e2396f1207fd69d24c442cb230c6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/udp_tunnel_nic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/080695e6f005e2396f1207fd69d24c442cb230c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b322532a4b774db1b480a2de84125910a70739a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b712da45bd9b9835d132e9fbc0c3e43c164cb1fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f82a2ded3d7a9098267c84f14eafdb98c4550ac5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74544","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.753","lastModified":"2026-08-17T06:19:51.597","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: validate offshift to prevent shift-out-of-bounds\n\nu32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,\n0-255) into the kernel knode object without bounds validation. When a\npacket later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates\n`ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit\nvalue promoted to a 32-bit int. Any offshift >= 32 is undefined behavior\nper C11 6.5.7p3, triggerable by an unprivileged user via user/network\nnamespaces.\n\nUBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43\nshift exponent 32 is too large for 32-bit type int\n\nFix this by rejecting offshift >= 16 during filter creation in\nu32_change()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/cls_u32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"313cb9ffc4101a885d791facf4b5ea3d5e06144d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"aef96eead2860cbfa371e4471d4f04412213b958","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/cls_u32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/313cb9ffc4101a885d791facf4b5ea3d5e06144d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aef96eead2860cbfa371e4471d4f04412213b958","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74545","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.850","lastModified":"2026-08-17T06:19:51.713","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtase: fix double free of multi-frag skb on DMA map failure\n\nIn rtase_start_xmit(), when the head buffer DMA mapping fails after\nrtase_xmit_frags() has mapped all fragments, the error path clears\nthe fragment descriptors with rtase_tx_clear_range(), which frees\nthe skb through the last-frag slot and accounts tx_dropped. Control\nthen falls through to the common error label, which frees the same\nskb a second time and counts it again.\n\nReturn right after clearing the fragments when the skb owns frags;\nthe no-frag case still drops through and frees the head skb once."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/realtek/rtase/rtase_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d6e882b89fdf80be0ab4f914ec10f75215e49495","lessThan":"4f09172aff5f73a5e914f4fbc0d00a1c2ea9f7cb","versionType":"git","status":"affected"},{"version":"d6e882b89fdf80be0ab4f914ec10f75215e49495","lessThan":"db986098f30881fafcc752800aa3b13fd289c922","versionType":"git","status":"affected"},{"version":"d6e882b89fdf80be0ab4f914ec10f75215e49495","lessThan":"de691dc3227b061c4d0beba9f0128fe1ff33dd68","versionType":"git","status":"affected"},{"version":"d6e882b89fdf80be0ab4f914ec10f75215e49495","lessThan":"6fb7b769d6ed6d1d2e02af4a80e57a2477f35086","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/realtek/rtase/rtase_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4f09172aff5f73a5e914f4fbc0d00a1c2ea9f7cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fb7b769d6ed6d1d2e02af4a80e57a2477f35086","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db986098f30881fafcc752800aa3b13fd289c922","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de691dc3227b061c4d0beba9f0128fe1ff33dd68","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74546","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:17:59.950","lastModified":"2026-08-19T17:21:09.453","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read\n\nIf the fan data becomes 0 between the FAN_DATA_VALID() check and the\nFAN_PERIOD_TO_RPM() conversion, it will result in a divide-by-zero crash\ndue to a race with a concurrent update of the cached fan value.\n\nFix a TOCTOU issue by reading fan data once."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/adt7470.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fc958a61ff6d34a0ec42744d3ff524ee202b2e9f","lessThan":"689a2ea75434131d0af58aeb7d51fde40e858b4d","versionType":"git","status":"affected"},{"version":"fc958a61ff6d34a0ec42744d3ff524ee202b2e9f","lessThan":"009240d057e26831cc925feaba4c490209c1d0ba","versionType":"git","status":"affected"},{"version":"fc958a61ff6d34a0ec42744d3ff524ee202b2e9f","lessThan":"d328175045176f85c15c369bd21dc551351e7935","versionType":"git","status":"affected"},{"version":"fc958a61ff6d34a0ec42744d3ff524ee202b2e9f","lessThan":"832069bec79cf6f903441c5769d3cdba95d0af33","versionType":"git","status":"affected"},{"version":"fc958a61ff6d34a0ec42744d3ff524ee202b2e9f","lessThan":"96ad57d31763559d376416cdf3bf5ae79bbbebec","versionType":"git","status":"affected"},{"version":"fc958a61ff6d34a0ec42744d3ff524ee202b2e9f","lessThan":"76963b04b2d1c648d69949d8dd521e1ff7f40b51","versionType":"git","status":"affected"},{"version":"fc958a61ff6d34a0ec42744d3ff524ee202b2e9f","lessThan":"1b46fe9dc8f8de59310f37e6c5e5c0e05ded46c3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/adt7470.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/009240d057e26831cc925feaba4c490209c1d0ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1b46fe9dc8f8de59310f37e6c5e5c0e05ded46c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/689a2ea75434131d0af58aeb7d51fde40e858b4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76963b04b2d1c648d69949d8dd521e1ff7f40b51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/832069bec79cf6f903441c5769d3cdba95d0af33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96ad57d31763559d376416cdf3bf5ae79bbbebec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d328175045176f85c15c369bd21dc551351e7935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74547","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.057","lastModified":"2026-08-19T17:21:09.567","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (adt7470) Fix busy-loop and I2C flooding in update thread\n\nWhen userspace configures 'auto_update_interval' to 0 via sysfs, the\nbackground kthread executes schedule_timeout_interruptible(0), which\nreturns immediately.\n\nIf 'num_temp_sensors' is concurrently or previously set to 0, the\nmsleep_interruptible() delay inside adt7470_read_temperatures() also\nbecomes 0. This combination forces the background thread into a tight,\nunbounded busy-loop, hogging the CPU and flooding the I2C bus with a\ncontinuous stream of transactions.\n\nFix this vulnerability by raising the lower limit of the clamp_val in\nauto_update_interval_store() from 0 to 500 milliseconds. This guarantees\na reasonable minimum sleep window between sensor updates, protecting the\nsystem from intentional or accidental I2C bus denial of service."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/adt7470.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"2c4c4d7cadd10b50b5489183bbbb9eb95f6f8344","versionType":"git","status":"affected"},{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"4dc1518f9cc57c6db99514cafeb02dd7117d5bda","versionType":"git","status":"affected"},{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"1325975a2eab265510e6036d8bf0c0068373d332","versionType":"git","status":"affected"},{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"1a42bd72a66205e439db1d1142442b62d393408a","versionType":"git","status":"affected"},{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"38e6b5ce5794ff09442231cc171c2be5e900bab3","versionType":"git","status":"affected"},{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"82d65f7ef11edcea0228745440b8b4b1f222c34c","versionType":"git","status":"affected"},{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"5ea299c3aa42a827f6a863eeead6de3525bbb17a","versionType":"git","status":"affected"},{"version":"89fac11cb3e7c5860c425dba14845c09ccede39d","lessThan":"cb0b7f9c43b0abbd422a7e4c2c85e91db429207c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/adt7470.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","lessThan":"2.6.29","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1325975a2eab265510e6036d8bf0c0068373d332","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a42bd72a66205e439db1d1142442b62d393408a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c4c4d7cadd10b50b5489183bbbb9eb95f6f8344","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38e6b5ce5794ff09442231cc171c2be5e900bab3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dc1518f9cc57c6db99514cafeb02dd7117d5bda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ea299c3aa42a827f6a863eeead6de3525bbb17a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82d65f7ef11edcea0228745440b8b4b1f222c34c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb0b7f9c43b0abbd422a7e4c2c85e91db429207c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74548","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.170","lastModified":"2026-08-19T17:21:09.690","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nforcedeth: fix UAF of txrx_stats in nv_remove\n\nnv_remove() frees the per-CPU txrx_stats before unregister_netdev().\nUntil unregister completes, ndo_get_stats64, the NAPI/xmit data path,\nand nv_close()/drain may still access txrx_stats, leading to a\nuse-after-free.\n\nFree the stats only after unregister_netdev()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/nvidia/forcedeth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9","versionType":"git","status":"affected"},{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"7c22b4ee0bd003cecfc14ca28981cb213e201f70","versionType":"git","status":"affected"},{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc","versionType":"git","status":"affected"},{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"cf2dcde2284562ff87830ca0b7fa2b06e95aef1e","versionType":"git","status":"affected"},{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"c9d24a205fd508b9999fcab6aca4c590490a12cf","versionType":"git","status":"affected"},{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"ae20a8a4de06a289d40b0a0633d8d573f1fcb049","versionType":"git","status":"affected"},{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1","versionType":"git","status":"affected"},{"version":"f4b633b911fd3b4cbe1dc065e8fb064078d0889d","lessThan":"22666ba1420164753d7b0f5a841986b25ace5435","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/nvidia/forcedeth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74549","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.270","lastModified":"2026-08-19T17:21:09.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nct6775-core) Prevent access to unsupported weight registers\n\nSashiko reports:\n\nDuring initialization of the nct6116 chip, the driver sets data->pwm_num\nto 5. However, it assigns several NCT6106 register arrays (such as\nNCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and\nNCT6106_REG_WEIGHT_TEMP_*) to data->REG_PWM and data->REG_WEIGHT_TEMP.\nThese arrays only contain 3 elements.\n\nIn nct6775_update_pwm(), the driver iterates up to data->pwm_num. If\ndata->has_pwm has bits 3 or 4 set (which is structurally possible for\nnct6116), the loop attempts to read elements at index 3 and 4 from these\n3-element arrays. This results in a global out-of-bounds read, which can\nbe caught by KASAN.\n\nFurthermore, the driver uses these garbage out-of-bounds values as\nhardware register addresses for subsequent read and write operations. This\nleads to invalid hardware register access, potentially causing hardware\nmisconfiguration or system crashes.\n\nThe underlying problem is that the chip does support up to five fan\ncontrol channels, but only the first three support weight control.\nFix the problem by extending the affected weight register arrays with\nzeroed fields. The driver uses zeroed register addresses to determine\nif a register is supported or not, and skips accesses for unsupported\nregisters."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/nct6775-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"0d11b2a10269ace29832f584d207ff3768f79dc5","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"4a77f1d72c6db04cbbfab0250292ac71fdea5f0a","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"513d847f7a95bbdbeaaf55fb942c38992587734f","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"25b528816f5d83be5236dc182692369e8c9402b0","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"689082a4cb166a7ae9729f7b12339e69fdad6c52","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"1b722740ac5c2b2070f9ba922f4e0f227faf0246","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"4ad2972ef0e1bd1018ad7a72661a4636ed7daecc","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"d0b704e569ac3b8416d8e02270cdc9bf830ed395","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/nct6775-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0d11b2a10269ace29832f584d207ff3768f79dc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1b722740ac5c2b2070f9ba922f4e0f227faf0246","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25b528816f5d83be5236dc182692369e8c9402b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a77f1d72c6db04cbbfab0250292ac71fdea5f0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ad2972ef0e1bd1018ad7a72661a4636ed7daecc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/513d847f7a95bbdbeaaf55fb942c38992587734f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/689082a4cb166a7ae9729f7b12339e69fdad6c52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0b704e569ac3b8416d8e02270cdc9bf830ed395","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74550","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.390","lastModified":"2026-08-19T17:21:10.020","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not send ICMP/NDISC Redirects when peer allocation fails\n\nWhen inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry\nunder memory pressure or tree size caps, redirect handlers previously fell\nback to sending un-rate-limited ICMP/NDISC Redirect messages.\n\nIn IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL.\nIn IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into\ninet_peer_xrlim_allow(), which returned true when peer == NULL.\n\nBecause ICMP/NDISC Redirects are not part of the default global rate limit\nmask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates\nan un-rate-limited ICMP packet storm.\n\nFix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and\nndisc_send_redirect() when peer is NULL."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/route.c","net/ipv6/ip6_output.c","net/ipv6/ndisc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"92d8682926342d2b6aa5b2ecc02221e00e1573a0","lessThan":"c0adf8b4247bcc5a145a25c1929006eb392580bb","versionType":"git","status":"affected"},{"version":"92d8682926342d2b6aa5b2ecc02221e00e1573a0","lessThan":"f5ecaa7ea7686fa7ecdb6affc9d3a9a42e4524b1","versionType":"git","status":"affected"},{"version":"92d8682926342d2b6aa5b2ecc02221e00e1573a0","lessThan":"21666f7af49a90ef44d474916b8ef4402dfd74f5","versionType":"git","status":"affected"},{"version":"92d8682926342d2b6aa5b2ecc02221e00e1573a0","lessThan":"5ec5f00fc606a6df8434948c4552b3cb1176595d","versionType":"git","status":"affected"},{"version":"92d8682926342d2b6aa5b2ecc02221e00e1573a0","lessThan":"828f6670d110ff2bf44c743037b38badc315704c","versionType":"git","status":"affected"},{"version":"92d8682926342d2b6aa5b2ecc02221e00e1573a0","lessThan":"dbc3791e3b2472e1ccc08947e0f83b443470ff4f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/route.c","net/ipv6/ip6_output.c","net/ipv6/ndisc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/21666f7af49a90ef44d474916b8ef4402dfd74f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ec5f00fc606a6df8434948c4552b3cb1176595d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/828f6670d110ff2bf44c743037b38badc315704c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0adf8b4247bcc5a145a25c1929006eb392580bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbc3791e3b2472e1ccc08947e0f83b443470ff4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5ecaa7ea7686fa7ecdb6affc9d3a9a42e4524b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74551","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.500","lastModified":"2026-08-19T17:21:10.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nzxt-smart2) DMA-align output buffer\n\nSashiko reports:\n\nWhen send_output_report() calls hid_hw_output_report(), the underlying USB\nHID core calls usb_interrupt_msg() which maps this buffer directly for DMA.\n\nWhen the DMA mapping flushes or invalidates the cacheline, it will corrupt\nthe adjacent variables (mutex, update_interval) that were modified\nconcurrently by the CPU. This causes memory corruption due to cacheline\nsharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA\nAPI debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings\nfor this violation.\n\nAny operation that triggers send_output_report() (like setting a fan speed\nor updating the interval) causes the USB DMA mapping. On systems with\nnon-coherent caches, this structural bug causes immediate and deterministic\nmemory corruption.\n\nAlign the output buffer to ARCH_DMA_MINALIGN to fix the problem."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/nzxt-smart2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"53e68c20aeb1e23419bed811aa3a309ceda200f9","lessThan":"81a6593b1c8dfb2694cd0ce39be01212d2b8436c","versionType":"git","status":"affected"},{"version":"53e68c20aeb1e23419bed811aa3a309ceda200f9","lessThan":"70ad543ce81f368411b6c721265a3b2d7ab4fda4","versionType":"git","status":"affected"},{"version":"53e68c20aeb1e23419bed811aa3a309ceda200f9","lessThan":"51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f","versionType":"git","status":"affected"},{"version":"53e68c20aeb1e23419bed811aa3a309ceda200f9","lessThan":"2332d35aaf206c17acf848522817252732596676","versionType":"git","status":"affected"},{"version":"53e68c20aeb1e23419bed811aa3a309ceda200f9","lessThan":"6a2dbce5da2d2163a5b684acf68a0e54582ff0fa","versionType":"git","status":"affected"},{"version":"53e68c20aeb1e23419bed811aa3a309ceda200f9","lessThan":"080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/nzxt-smart2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2332d35aaf206c17acf848522817252732596676","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51a76bc1b8e717ee3fc0d84f15ac51490ca5f76f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a2dbce5da2d2163a5b684acf68a0e54582ff0fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70ad543ce81f368411b6c721265a3b2d7ab4fda4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81a6593b1c8dfb2694cd0ce39be01212d2b8436c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74552","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.607","lastModified":"2026-08-19T17:21:10.360","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (lm90) Only report alarms if driver is ready\n\nUserspace can read sysfs attributes before driver registration is complete,\nimmediately after devm_hwmon_device_register_with_info() has been called.\nAt that time, data->hwmon_dev is not yet initialized. This can trigger\na NULL pointer access since lm90_update_device() and with it\nlm90_update_alarms_locked() will be called. This call schedules\nreport_work and lm90_report_alarms(), which passes the still-NULL\ndata->hwmon_dev to hwmon_notify_event() and triggers a NULL pointer\ndereference.\n\nFix the problem by only scheduling the report and alert workers\ndata->hwmon_dev is set."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/lm90.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f6d0775119fb905fb02eafa98d575cf8ee792d46","lessThan":"31ce62d36d859423dc39f9902f7c4c307b2e00e3","versionType":"git","status":"affected"},{"version":"f6d0775119fb905fb02eafa98d575cf8ee792d46","lessThan":"4eed33c7db5c0c573928d28d8a2c003642c679b8","versionType":"git","status":"affected"},{"version":"f6d0775119fb905fb02eafa98d575cf8ee792d46","lessThan":"70d9a71aa407044d70b50d356b6decf6659c4d56","versionType":"git","status":"affected"},{"version":"f6d0775119fb905fb02eafa98d575cf8ee792d46","lessThan":"075fce376cf852db9293481edce07c181a9b1f46","versionType":"git","status":"affected"},{"version":"f6d0775119fb905fb02eafa98d575cf8ee792d46","lessThan":"f0b791a006512a48b6348494cb6960598fa99a58","versionType":"git","status":"affected"},{"version":"f6d0775119fb905fb02eafa98d575cf8ee792d46","lessThan":"aa9429edf9fc0e90d6f4da19ea4b5495a54ab117","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/lm90.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/075fce376cf852db9293481edce07c181a9b1f46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/31ce62d36d859423dc39f9902f7c4c307b2e00e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4eed33c7db5c0c573928d28d8a2c003642c679b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70d9a71aa407044d70b50d356b6decf6659c4d56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa9429edf9fc0e90d6f4da19ea4b5495a54ab117","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0b791a006512a48b6348494cb6960598fa99a58","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74553","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.710","lastModified":"2026-08-19T17:21:10.487","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nct6775-core) Fix number of temperature registers for NCT6116\n\nUnlike NCT6106, NCT6116 only has three temperature registers, and with\nit only three temperature source and temperature source configuration\nregisters. The register addresses match those of NCT6106 and can be\nre-used.\n\nThe code used a separate array to list the temperature source registers\nfor NCT6116, but used the size of the NCT6106 register array to set\nthe number of registers. The NCT6106 register array provides six addresses,\nwhile the temperature source register array for NCT6116 only provides three\naddresses. This causes a KASAN report.\n\nBUG: KASAN: global-out-of-bounds in nct6775_probe+0x936/0x46f0 [nct6775]\nRead of size 2 at addr ffffffffc19561a6 by task modprobe/954\n...\nCall Trace:\n dump_stack+0x7d/0xa7\n print_address_description.constprop.0+0x1c/0x220\n ? __kasan_kmalloc.constprop.0+0xc9/0xd0\n ? __kmalloc_node_track_caller+0x194/0x5b0\n ? nct6775_probe+0x936/0x46f0 [nct6775]\n ? nct6775_probe+0x936/0x46f0 [nct6775]\n...\n\nFix the problem by hard-coding the number of temperature and temperature\nconfiguration registers to three for NCT6116. Drop the unnecessary\nNCT6116_REG_TEMP_SOURCE array and re-use NCT6106_REG_TEMP_SOURCE."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/nct6775-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"739d7fc6b6f662c8286912157f0c4912388aa292","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"9a87dfaa05c3c9d3a4cdb7eafc1ab4abc84f6eef","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"16c45bb3d3434cfb9ea264fa52090d0823240465","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"a42d727dae5701deac8bb2a75effadae7d681153","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"a7f47f5246cd6c3199e5fb2d4109cc53e766e3f0","versionType":"git","status":"affected"},{"version":"29c7cb485b321c024dedc168bcbb04451176b163","lessThan":"b0e8adb2ccb43009796897ced09f91636685c9d3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/nct6775-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/16c45bb3d3434cfb9ea264fa52090d0823240465","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/739d7fc6b6f662c8286912157f0c4912388aa292","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a87dfaa05c3c9d3a4cdb7eafc1ab4abc84f6eef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a42d727dae5701deac8bb2a75effadae7d681153","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7f47f5246cd6c3199e5fb2d4109cc53e766e3f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0e8adb2ccb43009796897ced09f91636685c9d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74554","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.830","lastModified":"2026-08-17T06:19:53.470","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()\n\nath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the\nfree_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is\nwrong: dp_peer->peer_id for an MLO peer always carries the\nATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with\nindex >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS\n(256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The\nintended bitmap entry also never gets cleared, so subsequent\nath12k_peer_ml_alloc() calls eventually run out of IDs.\n\nThe ID without the VALID bit is what ath12k_peer_ml_alloc() returned and\nis stored in ahsta->ml_peer_id. Use that instead.\n\nWhile there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so\nthe bitmap and ahsta->ml_peer_id stay in sync.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath12k/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ee16dcf573d5e3283fda601dd4bca6bc52251017","lessThan":"234b5cb81e6fcc1e3b31b13deff66130be55f36e","versionType":"git","status":"affected"},{"version":"ee16dcf573d5e3283fda601dd4bca6bc52251017","lessThan":"47abd2ca281531deee38a3b3770d885e270e9fc9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath12k/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/234b5cb81e6fcc1e3b31b13deff66130be55f36e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47abd2ca281531deee38a3b3770d885e270e9fc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74555","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:00.927","lastModified":"2026-08-19T17:21:10.613","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race\n\nCommit fbefe22811c3 (\"scsi: libsas: Don't always drain event workqueue\nfor HA resume\") introduced sas_resume_ha_no_sync() to avoid a deadlock:\nthe PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,\ncalls sas_deform_port() -> sas_destruct_devices(), which removes SCSI\ndevices and waits for the host to become runtime-active. But the host\ncannot resume until sas_resume_ha() -> sas_drain_work() returns, and the\ndrain is blocked on that very handler.\n\nHowever skipping the drain reintroduces a race: hisi_sas returns from\nresume before all PHY UP work and libsas discovery work finish. The\ncontroller may then autosuspend while disks are still waking up. The\ndisks issue IO to a suspended controller, the IO fails, and the disks\nget disabled.\n\nFix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT\nnotification to after sas_drain_work(). By then the host resume is about\nto complete, so device removal through device_link no longer blocks on\nthe resume and the cycle is broken.\n\nWith the deadlock gone, restore sas_resume_ha() (the draining variant)\nin hisi_sas and remove sas_resume_ha_no_sync().\n\nThe reorder is safe for the other libsas consumers (isci, pm8001,\naic94xx, mvsas). During suspend, sas_suspend_devices() calls\nsas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to\nNULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a\ntimed-out phy's disk is immediately rejected by the LLDD before reaching\nhardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET),\nand pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both\ncomplete directly via scsi_done() without entering SCSI EH. This is\nidentical in both the old and new ordering since lldd_dev_gone runs\nduring suspend, before resume. The reorder only affects when the\nPHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work()\nvs. asynchronous after resume returns), not whether I/O can reach the\ndevice. aic94xx and mvsas do not register any PM ops and never reach\nthis code path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/hisi_sas/hisi_sas_v3_hw.c","drivers/scsi/libsas/sas_init.c","include/scsi/libsas.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fbefe22811c3140a686e407e114789ebf328a9a2","lessThan":"09357f067122e2e28ec52e27013a1660a1571618","versionType":"git","status":"affected"},{"version":"fbefe22811c3140a686e407e114789ebf328a9a2","lessThan":"e50a6523a603594a6d92cdecfe11997d639410a3","versionType":"git","status":"affected"},{"version":"fbefe22811c3140a686e407e114789ebf328a9a2","lessThan":"c391b5899dd46485a5893696c12ae3e95a3a7325","versionType":"git","status":"affected"},{"version":"fbefe22811c3140a686e407e114789ebf328a9a2","lessThan":"9e24b47ef81d43b3fb1b14294f09991640c79fcc","versionType":"git","status":"affected"},{"version":"fbefe22811c3140a686e407e114789ebf328a9a2","lessThan":"b9c44a14062093e9fc2d6bddc696cfceadb482d7","versionType":"git","status":"affected"},{"version":"fbefe22811c3140a686e407e114789ebf328a9a2","lessThan":"3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/hisi_sas/hisi_sas_v3_hw.c","drivers/scsi/libsas/sas_init.c","include/scsi/libsas.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/09357f067122e2e28ec52e27013a1660a1571618","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e24b47ef81d43b3fb1b14294f09991640c79fcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9c44a14062093e9fc2d6bddc696cfceadb482d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c391b5899dd46485a5893696c12ae3e95a3a7325","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e50a6523a603594a6d92cdecfe11997d639410a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74556","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.047","lastModified":"2026-08-19T17:21:10.753","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn->data buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes.  For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn->data via\niscsi_tcp_data_recv_prep(), but it does so without the same check.  The\nonly upstream bound on in.datalen is conn->max_recv_dlength, the\ninitiator's advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144).  A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn->data buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn->data\nwhen present, and otherwise complete the PDU with no data.  Fold the\nopcode into that case group rather than duplicating the check."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/libiscsi_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"a51812842084fd390590ab8dc0431f10c73ddc56","versionType":"git","status":"affected"},{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"a8f94cc9f0e5759252551be3a172960c57f21f54","versionType":"git","status":"affected"},{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"f1a3a51fc5dba0e99532379665069f1700da6b44","versionType":"git","status":"affected"},{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"c97b5265cc47775f77fd2a23d6bde0426997b233","versionType":"git","status":"affected"},{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"084af0253673425ce2ae62e3c7f74f0dd023711b","versionType":"git","status":"affected"},{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"72815741715bd41556dac5eeb068bf0f8af06ee7","versionType":"git","status":"affected"},{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676","versionType":"git","status":"affected"},{"version":"a081c13e39b5c17052a7b46fafa61019c4c110ff","lessThan":"c1dea15f819cded9b3faf58f8bec72323568b6e6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/libiscsi_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","lessThan":"2.6.29","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74557","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.160","lastModified":"2026-08-19T17:21:10.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Fix stale-data leak into the SCSI sense buffer\n\niscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the\ntarget-supplied data segment.  The segment carries a 2-byte sense length\nfollowed by the sense bytes, so it must hold 2 + senselen bytes, but the\nbounds check only requires datalen >= senselen:\n\n\tsenselen = get_unaligned_be16(data);\n\tif (datalen < senselen)\n\t\tgoto invalid_datalen;\n\tmemcpy(sc->sense_buffer, data + 2,\n\t       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));\n\nA target that returns a SCSI Response whose datalen equals senselen\n(with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +\n2 read up to two bytes past the received data.  Those bytes are stale\nconn->data contents and end up in the command's sense buffer, which is\nreturned to userspace.\n\nAccount for the 2-byte sense length prefix in the check."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/libiscsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"812f1ae95b22419422972748f173b0916ee4d621","versionType":"git","status":"affected"},{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"fef6167e8149896cd81bea333fd51b1c91239149","versionType":"git","status":"affected"},{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"baa04572673125e4d5bc309b4077d1cb46cc78d1","versionType":"git","status":"affected"},{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"7567f06abdefb1caf2d836107c4d08c5185c650e","versionType":"git","status":"affected"},{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"60499924faf4ef97e84228c20515218ef121facf","versionType":"git","status":"affected"},{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"3ef209ca0b4b68c75e9a814d90cc916026b5a6ac","versionType":"git","status":"affected"},{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"1f07a897d43c63e6c9458bf77450defef39b5833","versionType":"git","status":"affected"},{"version":"7996a778ff8c717cb1a7a294475c59cc8f1e9fb8","lessThan":"98b87885de4b7f605533a2860685f5689fce8e82","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/libiscsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.18","status":"affected"},{"version":"0","lessThan":"2.6.18","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/1f07a897d43c63e6c9458bf77450defef39b5833","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ef209ca0b4b68c75e9a814d90cc916026b5a6ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60499924faf4ef97e84228c20515218ef121facf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7567f06abdefb1caf2d836107c4d08c5185c650e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/812f1ae95b22419422972748f173b0916ee4d621","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98b87885de4b7f605533a2860685f5689fce8e82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/baa04572673125e4d5bc309b4077d1cb46cc78d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fef6167e8149896cd81bea333fd51b1c91239149","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74558","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.267","lastModified":"2026-08-17T06:19:53.910","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: reclaim invalid Tx descriptors in ZC batch path\n\nThe zero-copy Tx batch parser stops when it encounters an invalid\ndescriptor. If this happens after one or more continuation descriptors,\nthe Tx consumer can be advanced past fragments that are neither submitted\nto the driver nor returned to userspace through the completion ring.\n\nA similar problem occurs when a packet exceeds xdp_zc_max_segs. The\ndescriptors consumed up to the limit are released without completion, and\nthe remaining continuation descriptors can subsequently be interpreted\nas the beginning of another packet.\n\nParse Tx batches in packet units and distinguish descriptors belonging to\ncomplete valid packets from descriptors consumed while draining an\ninvalid or oversized packet. Return the former to the driver and append\nthe latter to the CQ address area so userspace can reclaim their UMEM\nframes.\n\nTreat a standalone invalid descriptor as a one-descriptor reclaim-only\npacket. Advancing the Tx-ring consumer releases the ring slot, but does\nnot by itself return ownership of the referenced UMEM frame to userspace.\n\nOnce draining starts, continue until the packet's end-of-packet\ndescriptor is consumed. Preserve the drain state on the socket when EOP\nhas not yet been supplied, so draining can continue during a later call.\nLeave incomplete but otherwise valid packets on the Tx ring.\n\nShared-UMEM pools using multi-buffer Tx also need packet-framed parsing.\nWalk their Tx sockets one packet at a time, preserving the existing\nper-socket fairness scheme, instead of using the legacy one-descriptor\nfallback. Keep that fallback for shared pools that do not use\nmulti-buffer Tx. Since the drain state is maintained per socket and both\nthe singular and shared paths can resume an interrupted drain, changing\nthe socket list from singular to shared requires no special bind-time\ntransition.\n\nCQ entries are positional, and drivers may complete only part of the Tx\nwork returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only\nentries cannot be published immediately when earlier driver-visible\ndescriptors are still outstanding.\n\nTrack the number of driver-visible CQ entries preceding the reclaim\nentries. Let xsk_tx_completed() publish partial hardware Tx completions,\nand publish the reclaim entries only after every earlier Tx descriptor\nhas completed. Complete a reclaim-only batch immediately when there is no\ndriver-visible work in front of it, and prevent another Tx batch from\nbeing appended while reclaim entries remain pending.\n\nAlso cap batch processing by the size of the pool's temporary descriptor\narray, as Tx rings belonging to sockets sharing a UMEM may have different\nsizes.\n\nThis ensures that every invalid Tx descriptor consumed by the ZC batch\npath is either submitted to the driver as part of a valid packet or\nreturned to userspace without violating CQ completion ordering."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/networking/af_xdp.rst","include/net/xsk_buff_pool.h","net/xdp/xsk.c","net/xdp/xsk_buff_pool.c","net/xdp/xsk_queue.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"e7ce2bad0c33471c8da4dd73dff2119a68f96f3a","versionType":"git","status":"affected"},{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/networking/af_xdp.rst","include/net/xsk_buff_pool.h","net/xdp/xsk.c","net/xdp/xsk_buff_pool.c","net/xdp/xsk_queue.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/72f2b4516faf55d4dfac2414649d3cffa5fd2c5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7ce2bad0c33471c8da4dd73dff2119a68f96f3a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74559","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.390","lastModified":"2026-08-17T06:19:54.007","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: drain continuation descs after overflow in xsk_build_skb()\n\nFix generic xmit path multi-buffer logic when packets are either too big\n(count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is\nincluded in fragmented packet. Introduce xdp_sock::drain_cont and act\nupon this flag - when it is set, keep on consuming descriptors from\nAF_XDP Tx ring and put them directly onto Cq. Previously these\ndescriptors were silently lost and could never be reached again."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/xdp_sock.h","net/xdp/xsk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"ceb00cb87a22c42d20c39336213db2b843ca9e34","versionType":"git","status":"affected"},{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"5e94d74e4f3baebaa083288f33b4be7ce0a34982","versionType":"git","status":"affected"},{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"bd44a6dcd4248883de90f5dad53ae80066e27096","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/xdp_sock.h","net/xdp/xsk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5e94d74e4f3baebaa083288f33b4be7ce0a34982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd44a6dcd4248883de90f5dad53ae80066e27096","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ceb00cb87a22c42d20c39336213db2b843ca9e34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74560","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.483","lastModified":"2026-08-17T06:19:54.100","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx\n\nThis patch is inspired by the check[1] from sashiko. It says when\noverflow happens, the address of cq to be published is invalid.\nActually the severer thing is the whole process of publishing the\naddress of cq in this particular case is not right: it should truely\npublish the address and advance the cached_prod in cq as long as it\nreads descriptors from txq.\n\nThe following is the full analysis.\nxsk_drop_skb() is called in three places, which all discard a partially\nbuilt multi-buffer skb:\n1) xsk_build_skb() -EOVERFLOW error path: packet exceeds MAX_SKB_FRAGS\n2) __xsk_generic_xmit() post-loop cleanup: an invalid descriptor in\n   the TX ring prevents the partial packet from completing\n3) xsk_release(): socket close while xs->skb holds an incomplete packet\n\nIn all three cases, the TX descriptors for the already-processed frags\nhave been consumed from the TX ring (xskq_cons_release), and CQ slots\nhave been reserved. However, xsk_drop_skb() calls xsk_consume_skb()\nwhich cancels the CQ reservations via xsk_cq_cancel_locked(). Since\nthe buffer addresses never appear in the completion queue, userspace\npermanently loses track of these buffers.\n\nFix this by letting consume_skb() trigger the existing xsk_destruct_skb\ndestructor, which already submits buffer addresses to the CQ via\nxsk_cq_submit_addr_locked().\n\nNote that cancelling the descriptors back to the TX ring (via\nxskq_cons_cancel_n) is not a appropriate option because an oversized\npacket that always exceeds MAX_SKB_FRAGS would be retried indefinitely,\nwhich is an obviously deadlock bug in the TX path.\n\nAlso move the desc->addr assignment in xsk_build_skb() above the\noverflow check so that the current descriptor's address is recorded\nbefore a potential -EOVERFLOW jump to free_err, consistent with the\nzerocopy path in xsk_build_skb_zerocopy().\n\n[1]: https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xdp/xsk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"05e283466b86e0b25a5209a3eafe87aa9886064a","versionType":"git","status":"affected"},{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"a0528ab6af62bf57153caaf8ea28e5fcb0e18fd4","versionType":"git","status":"affected"},{"version":"cf24f5a5feeaae34c1a34d1e04f8ac697290427a","lessThan":"a3c8382ebce4780c6b3ace2c09bc342313ac0186","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xdp/xsk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05e283466b86e0b25a5209a3eafe87aa9886064a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0528ab6af62bf57153caaf8ea28e5fcb0e18fd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3c8382ebce4780c6b3ace2c09bc342313ac0186","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74561","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.590","lastModified":"2026-08-17T06:19:54.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop\nreplace without holding nh->lock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh->lock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n  BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n  Read of size 8 at addr ffff888012953e18 by task exploit/146\n   nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n   replace_nexthop (net/ipv4/nexthop.c:2610)\n   rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route's sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock\naround it would invert the established tb6_lock -> nh->lock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"081efd18326e353c6fbfdeff903a83edde953f72","lessThan":"44f53e4331a30fabc38a411fae7524341b618db3","versionType":"git","status":"affected"},{"version":"081efd18326e353c6fbfdeff903a83edde953f72","lessThan":"4787a6d2629b4e8c0b6bacab1f75c1660eca44d9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74562","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.690","lastModified":"2026-08-17T06:19:54.303","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: take nh->lock for f6i_list walks in replace check and notify\n\nfib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list\nduring an RTNL-serialized nexthop replace without holding nh->lock. IPv6\nRTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under\nnh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a\nconcurrent route delete that unlinks and frees a fib6_info:\n\n  BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799)\n  Read of size 4 at addr ffff888014607e64 by task exploit/143\n   rt6_fill_node.isra.0 (net/ipv6/route.c:5799)\n   fib6_rt_update (net/ipv6/route.c:6412)\n   __nexthop_replace_notify (net/ipv4/nexthop.c:2542)\n   rtm_new_nexthop (net/ipv4/nexthop.c:2554)\n   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\n  BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605)\n  Read of size 8 at addr ffff888014a7d068 by task exploit/142\n   fib6_check_nh_list (net/ipv4/nexthop.c:1605)\n   rtm_new_nexthop (net/ipv4/nexthop.c:2575)\n   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nBoth walks only read the entries and take no tb6_lock, so protect them\nwith nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC\nunder the lock."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"081efd18326e353c6fbfdeff903a83edde953f72","lessThan":"bb2b072c619c1f741a6234257050f72005dc63ef","versionType":"git","status":"affected"},{"version":"081efd18326e353c6fbfdeff903a83edde953f72","lessThan":"072cd1f21819dedd2252e704d255de3b0cfc61a7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/072cd1f21819dedd2252e704d255de3b0cfc61a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb2b072c619c1f741a6234257050f72005dc63ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74563","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.790","lastModified":"2026-08-19T17:21:11.107","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()\n\nrds_tcp_laddr_check() looks up a scoped IPv6 interface with\ndev_get_by_index_rcu(), drops the RCU read-side lock, and only then\npasses the bare struct net_device * into ipv6_chk_addr().\n\ndev_get_by_index_rcu() only keeps the device alive within the same RCU\nread-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can\nfree the net_device; ipv6_chk_addr() then dereferences the stale pointer\nin __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading\nfreed memory.\n\nKeep the RCU read-side lock held across the ipv6_chk_addr() call instead\nof dropping it right after the lookup, so the device cannot be freed\nwhile it is in use.\n\n  BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n  Read of size 8 at addr ffff8880106ec000 by task exploit/153\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998)\n   ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972)\n   rds_tcp_laddr_check (net/rds/tcp.c:370)\n   rds_bind (net/rds/bind.c:248)\n   __sys_bind (net/socket.c:1920)\n   __x64_sys_bind (net/socket.c:1956)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"f8a8977af2134a1d91e5f9773cb7d9d53278c830","versionType":"git","status":"affected"},{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"ba95bce5dfe6e2ef602a87e0557225f2934ccb5c","versionType":"git","status":"affected"},{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"c4933624a6f416ecfcc31ab58d585da1207a0597","versionType":"git","status":"affected"},{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef","versionType":"git","status":"affected"},{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff","versionType":"git","status":"affected"},{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"b1d480fce05f857dc438080cd8c9244b84a83494","versionType":"git","status":"affected"},{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"8398bc477d3cb3e2b018a5aaac2bec0f69acda30","versionType":"git","status":"affected"},{"version":"eee2fa6ab3225192d6d894c54a6fb02ac9efdff6","lessThan":"78f75d632f74b8de0f081a128588f7c37d0d1164","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78f75d632f74b8de0f081a128588f7c37d0d1164","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8398bc477d3cb3e2b018a5aaac2bec0f69acda30","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1d480fce05f857dc438080cd8c9244b84a83494","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba95bce5dfe6e2ef602a87e0557225f2934ccb5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4933624a6f416ecfcc31ab58d585da1207a0597","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8a8977af2134a1d91e5f9773cb7d9d53278c830","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74564","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:01.903","lastModified":"2026-08-19T17:21:11.280","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH\n\nThe XT_HASHLIMIT_RATE_MATCH flag mode changes the semantics of the\ndsthash_ent structure which represents an entry in the hashtable.  There\nis a union area which uses a different layout to express the rate match\nmode.\n\nUpdate .checkentry path to validate the XT_HASHLIMIT_RATE_MATCH mode\nflag is requested by two or more different rules that refer to the same\nhashtable. Otherwise, uninitialized access to the burst field in the\nunion is possible.\n\nReject the use of the XT_HASHLIMIT_RATE_MATCH mode flag if set on by\nrevision less than 3 too."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/xt_hashlimit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"402befce5854c195058cf4bab7c78ca286068a26","versionType":"git","status":"affected"},{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"dee686b5e7f21180538ff719867702f411c8eb5c","versionType":"git","status":"affected"},{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"f76ab783e7d8d33e33dd7dfa697297f70d57b0e8","versionType":"git","status":"affected"},{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"24683fea1f06bd3bd2707b99460e859bc6464c22","versionType":"git","status":"affected"},{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0","versionType":"git","status":"affected"},{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"d186f77d18bdfb252d401ff992ca3001a6a65a0f","versionType":"git","status":"affected"},{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"06a76334243ccd875a981aa8bb46c0f931ef1e3b","versionType":"git","status":"affected"},{"version":"bea74641e3786d51dcf1175527cc1781420961c9","lessThan":"305b63e1402267459fdabb183af4527f6799eebf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/xt_hashlimit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/06a76334243ccd875a981aa8bb46c0f931ef1e3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24683fea1f06bd3bd2707b99460e859bc6464c22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/305b63e1402267459fdabb183af4527f6799eebf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32ec8d4aba2cf22e12bdc28df8c4bd833c195fc0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/402befce5854c195058cf4bab7c78ca286068a26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d186f77d18bdfb252d401ff992ca3001a6a65a0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dee686b5e7f21180538ff719867702f411c8eb5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f76ab783e7d8d33e33dd7dfa697297f70d57b0e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74565","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.013","lastModified":"2026-08-17T06:19:54.657","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: make nft_object rhltable per table\n\nThe nft_object rhltable is global, this allows for accessing objects\nthat are being dismangled from lookup path by other existing netns.\nGiven the nft_obj_destroy() releases the object inmediately, this might\nlead to use-after-free of these objects that are being released.\nMake the existing rhltable per table to address this issue to deal with\nwith the nft_rcv_nl_event() path too.\n\nUpdate nft_obj_lookup() to take the table as non-const, otherwise,\ncompiler complains when passing the objname_ht to rhltable_lookup()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/netfilter/nf_tables.h","net/netfilter/nf_tables_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d44175aa5bb5f68772b1eb0306554812294ca52","lessThan":"1948e4f85b855618b5b9a27265f98d816f4cb7cb","versionType":"git","status":"affected"},{"version":"4d44175aa5bb5f68772b1eb0306554812294ca52","lessThan":"63ba12b664a2cd3220ed43e22c717715f4cc2ae8","versionType":"git","status":"affected"},{"version":"4d44175aa5bb5f68772b1eb0306554812294ca52","lessThan":"7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af","versionType":"git","status":"affected"},{"version":"4d44175aa5bb5f68772b1eb0306554812294ca52","lessThan":"f4f699790590bd0896c48a71e9232a65198f92f0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/netfilter/nf_tables.h","net/netfilter/nf_tables_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1948e4f85b855618b5b9a27265f98d816f4cb7cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63ba12b664a2cd3220ed43e22c717715f4cc2ae8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4f699790590bd0896c48a71e9232a65198f92f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74566","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.120","lastModified":"2026-08-19T17:21:11.443","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring key-chunk byte order agree with keyring_diff_objects()\n\nkeyring_get_key_chunk() loads description bytes into the index chunk low\naddress first, while keyring_diff_objects() numbers the first differing\nbit from the low end and folds the absolute byte index into the level\nwithout removing the inline-prefix offset the level already carries.\nThe two disagree on byte order and bit position, so the array can be\ntold two keys first differ at a bit that does not differ in the chunk\nthe walker uses, letting crafted descriptions collide into one node.\n\nLoad the chunk in the order keyring_diff_objects() assumes and drop the\ninline-prefix length when folding the byte index into the level.  This\nonly changes the in-memory ordering used to place keys within a keyring;\nadd, search and read of non-colliding keys are unaffected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"414bcf37d81ce9b3823aabc06b04c97fdcbe489b","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"abe43c661efb753d5ee35ad8ace4bbb16fa9afd0","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"f81920917074e3c4ad4fba06fe8c56738d010606","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"bd0f976ef89dce6db458bf75bc2cf51127becc41","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"7269df3e7fcfa308e6a456305162f7788747bdbd","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"3d9f16c0b643ceac305526b2e2fe25c2c6166926","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"7e5397a3fed0dee7779bd084bec3c0584db3c930","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"58565eef0f8d861aae92abfb7658458d661cee17","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3d9f16c0b643ceac305526b2e2fe25c2c6166926","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/414bcf37d81ce9b3823aabc06b04c97fdcbe489b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/58565eef0f8d861aae92abfb7658458d661cee17","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7269df3e7fcfa308e6a456305162f7788747bdbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e5397a3fed0dee7779bd084bec3c0584db3c930","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abe43c661efb753d5ee35ad8ace4bbb16fa9afd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd0f976ef89dce6db458bf75bc2cf51127becc41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f81920917074e3c4ad4fba06fe8c56738d010606","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74567","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.227","lastModified":"2026-08-19T17:21:11.563","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: fix out-of-bounds read in keyring_get_key_chunk()\n\nFor description-level chunks keyring_get_key_chunk() advances the read\npointer by level * sizeof(long) past the inline prefix but only\nbounds-checks the prefix, so a long enough key description is read past\nits kmemdup(desc, desc_len + 1) allocation.  Compute the full byte\noffset and bounds-check the description against it before reading.\n\nThe walk only reaches a description-level chunk when two keys collide\nthrough the hash, x, type and domain_tag chunks, so this is reached from\nan unprivileged add_key(2) with a crafted pair of same-type keys whose\nindex hashes collide; KASAN reports a slab-out-of-bounds read."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"79916f40d4ab1b4ae694d8c024fd179454bfe46e","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"e5b01998cef8d7f613200230ccaadebe5de9135c","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"d1933e03e8c74a018550c31a393b79c4d95bff40","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"3a744838453fb9309ce5a5526d3252e211d60152","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"e9417d21a22ad2ec398e78fcf084b717ce92cf2f","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"8dba33c1e779d0fb9a2acb31e354cf0fc0229111","versionType":"git","status":"affected"},{"version":"f771fde82051976a6fc0fd570f8b86de4a92124b","lessThan":"63918731f9ae25b5deb022f118e941e6dddfcef4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/keyring.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/3a744838453fb9309ce5a5526d3252e211d60152","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c0c26f751e50d3027eacc4d7d0fabc31f1d7e6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63918731f9ae25b5deb022f118e941e6dddfcef4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/79916f40d4ab1b4ae694d8c024fd179454bfe46e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8dba33c1e779d0fb9a2acb31e354cf0fc0229111","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1933e03e8c74a018550c31a393b79c4d95bff40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5b01998cef8d7f613200230ccaadebe5de9135c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9417d21a22ad2ec398e78fcf084b717ce92cf2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74568","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.370","lastModified":"2026-08-17T06:19:55.053","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Fix race between LPI release and re-registration\n\nFix a potential race between decrementing an LPI's reference count and\nevicting that structure from the LPI xarray.\n\nLPI structures are maintained in the VGIC LPI xarray (dist->lpi_xa).\nWhen the reference count of an LPI structure drops to zero,\nvgic_release_lpi_locked() removes the structure from the xarray and\nfrees it under the xarray lock.\n\nHowever, the release of an LPI can race with a concurrent LPI\nre-registration with the same INTID via vgic_add_lpi() on another CPU,\nsince the reference count drop and the xarray eviction are not performed\nin a single atomic step. This can happen e.g. if the guest issues a\nDISCARD while the LPI is still referenced from a vCPU's active-pending\nlist (ap_list), and the same INTID is re-mapped via MAPTI.\n\nParticularly, vgic_release_lpi_locked() is called from two distinct\npaths: direct release via vgic_put_irq(), and deferred release via\nvgic_release_deleted_lpis(). During direct release, the issue can result\nin deleting a newly registered LPI from the xarray:\n\n  CPU0 (Releasing LPI)                    CPU1 (Adding new LPI)\n  ====================                    =====================\n  vgic_put_irq()\n      __vgic_put_irq()\n          refcount_dec_and_test()\n                                          vgic_add_lpi()\n                                              xa_lock_irqsave()\n                                              old_irq = xa_load(.., intid)\n                                              vgic_try_get_irq_ref(old_irq) == false\n                        new IRQ inserted -->  __xa_store(.., intid, ..)\n                                              xa_unlock_irqrestore()\n  xa_lock_irqsave();\n  vgic_release_lpi_locked()\n      __xa_erase(.., irq->intid)   <-- BUG: new IRQ is erased\n      kfree_rcu(old_irq)\n\nDuring the deferred release path, the old IRQ can be leaked:\n\n  CPU0 (Releasing LPI)                    CPU1 (Adding new LPI)\n  ====================                    =====================\n  vgic_put_irq_norelease()\n      __vgic_put_irq()\n          refcount_dec_and_test()\n      irq->pending_release = true\n                                          vgic_add_lpi()\n                                              xa_lock_irqsave()\n                                              old_irq = xa_load(.., intid)\n                                              vgic_try_get_irq_ref(oldirq) == false\n                 BUG: old IRQ overwritten --> __xa_store(.., intid, ..)\n                                              xa_unlock_irqrestore()\n\n  vgic_release_deleted_lpis()\n      xa_lock_irqsave()\n      xa_for_each() { .. } <-- old IRQ with pending_release = true\n                               is gone, so it cannot be released\n\nTo fix the direct release path, move the reference count drop inside\nthe xarray lock, making sure that vgic_add_lpi() never encounters the\nto-be-released LPI.\n\nIn the deferred release path, the refcount drop must happen under a raw\nspinlock, so the xarray lock cannot be grabbed, and the same solution\ndoes not work. Instead, update vgic_add_lpi(), so that if it evicts\nan LPI from the xarray, it takes on the responsibility of freeing it.\nConsequently, an LPI may now be freed concurrently after a deferred\nrelease drops the refcount, so accessing the pending_release field is no\nlonger safe from use-after-free. Delete all uses of the flag, and update\nvgic_release_deleted_lpis() to identify orphaned LPIs purely based on\ntheir refcount."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kvm/vgic/vgic-its.c","arch/arm64/kvm/vgic/vgic.c","include/kvm/arm_vgic.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3a08a6ca7c373198c84e2a8c025c395ee966ff8a","lessThan":"292e80a159aa88635bf668a7212cfdf526b8bd52","versionType":"git","status":"affected"},{"version":"3a08a6ca7c373198c84e2a8c025c395ee966ff8a","lessThan":"cbfe2b24a1ea9de35032dbdd100fdc700f5be92d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kvm/vgic/vgic-its.c","arch/arm64/kvm/vgic/vgic.c","include/kvm/arm_vgic.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/292e80a159aa88635bf668a7212cfdf526b8bd52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbfe2b24a1ea9de35032dbdd100fdc700f5be92d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74569","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.517","lastModified":"2026-08-19T17:21:11.713","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()\n\nsip_help_tcp() stores the size change of each NAT-rewritten SIP message\nin s16 diff and accumulates it in s16 tdiff, but a single message can\ngrow by more than S16_MAX while the packet stays under the 65535\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long\nContact list expands the message by tens of kilobytes. diff then wraps,\nand \"datalen = datalen + diff - msglen\" yields a huge unsigned datalen,\nso the next iteration's ct_sip_get_header() reads past the linearized skb\ntail.\n\nWiden diff, tdiff and the seq_adjust hook to s32. Both are bounded by the\n65535 byte packet limit, and the seqadj core is already s32\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is\nrejected.\n\n  BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n  Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25\n   ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n   sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)\n   nf_confirm (net/netfilter/nf_conntrack_proto.c:183)\n   nf_hook_slow (net/netfilter/core.c:619)\n   ip6_output (net/ipv6/ip6_output.c:246)\n   ip6_forward (net/ipv6/ip6_output.c:690)\n   ipv6_rcv (net/ipv6/ip6_input.c:351)\n   __netif_receive_skb_one_core (net/core/dev.c:6212)\n   process_backlog (net/core/dev.c:6676)\n   __napi_poll (net/core/dev.c:7735)\n   net_rx_action (net/core/dev.c:7955)\n   handle_softirqs (kernel/softirq.c:622)\n   run_ksoftirqd (kernel/softirq.c:1076)\n   ..."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/netfilter/nf_conntrack_sip.h","net/netfilter/nf_conntrack_sip.c","net/netfilter/nf_nat_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d","versionType":"git","status":"affected"},{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c","versionType":"git","status":"affected"},{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"32d4abc8923b0d4046fd63ad6e4917872e44eb6d","versionType":"git","status":"affected"},{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"63eea41759fd682229c14e0a2205802b46d106f3","versionType":"git","status":"affected"},{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"c97621a110e386b2dd69e276eb699e1d3cec581d","versionType":"git","status":"affected"},{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"f74554e67ccf04d1fa71069e8c9afa2717e40716","versionType":"git","status":"affected"},{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64","versionType":"git","status":"affected"},{"version":"f5b321bd37fbec9188feb1f721ab46a5ac0b35da","lessThan":"db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/netfilter/nf_conntrack_sip.h","net/netfilter/nf_conntrack_sip.c","net/netfilter/nf_nat_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74570","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.637","lastModified":"2026-08-17T06:19:55.317","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: harden runlist realloc size calculations\n\nAdd a shared helper to safely convert runlist element counts to byte sizes\nusing overflow checks, and use it in both ntfs_rl_realloc() and\nntfs_rl_realloc_nofail()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/runlist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"11ccc9107dc460de28af90fac1f42404d9802735","lessThan":"57e7b8bf7b02a0140463fea786e5172cbdf2da2f","versionType":"git","status":"affected"},{"version":"11ccc9107dc460de28af90fac1f42404d9802735","lessThan":"8bed376124ab4505b70083a2b91f2c7ef6d51e24","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/runlist.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/57e7b8bf7b02a0140463fea786e5172cbdf2da2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8bed376124ab4505b70083a2b91f2c7ef6d51e24","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74571","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.733","lastModified":"2026-08-17T06:19:55.417","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: skip global block reserve accounting for rescue mounts\n\n[BUG]\nMounting with rescue=ibadroots after corrupting the block group tree\nroot triggers a NULL pointer dereference:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000100\n  RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]\n  Call Trace:\n   fill_dummy_bgs+0xd4/0x120 [btrfs]\n   open_ctree+0xc6e/0x1ca0 [btrfs]\n   btrfs_get_tree+0x50d/0xa40 [btrfs]\n\nThe same crash occurs with a corrupted raid stripe tree root, via\nbtrfs_read_block_groups() instead of fill_dummy_bgs().\n\n[CAUSE]\nWith rescue=ibadroots, btrfs_read_roots() allows the mount to continue\nwhen either root cannot be read, leaving the corresponding root pointer\nNULL while its on-disk feature bit remains set.\n\nbtrfs_update_global_block_rsv() then dereferences the missing root based\non the feature bit alone.\n\n[FIX]\nRescue mounts are fully read-only and cannot start transactions, so the\nglobal reserve is never consumed. Under btrfs_is_full_ro(), mark the\nreserve as full and return before performing the accounting.\n\nAnd since we need to check if the fs is mount fully RO, export\nfs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.\n\n[ Squash the fs_is_full_ro() export commit into this one. ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/block-rsv.c","fs/btrfs/disk-io.c","fs/btrfs/fs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8dbfc14fc736eb701089aff09645c3d4ad3decb1","lessThan":"076349e4c8d11f6b58c4549976a513b2b4dc6df2","versionType":"git","status":"affected"},{"version":"8dbfc14fc736eb701089aff09645c3d4ad3decb1","lessThan":"51a0e8399858621442807a26057bcd1cd3ced046","versionType":"git","status":"affected"},{"version":"cbec34d3021d47007a0334c634f7053dbaf93d02","versionType":"git","status":"affected"},{"version":"1e8087589b5cf6fa17adaf57b64cf1656d77dfec","versionType":"git","status":"affected"},{"version":"6.1.43","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.4.8","lessThan":"6.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/block-rsv.c","fs/btrfs/disk-io.c","fs/btrfs/fs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/076349e4c8d11f6b58c4549976a513b2b4dc6df2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51a0e8399858621442807a26057bcd1cd3ced046","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74572","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.837","lastModified":"2026-08-17T06:19:55.507","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: fix deadlock between metadata writeback and transaction commit\n\nWhen writing out metadata extent buffers in a zoned filesystem,\nbtree_writepages() holds fs_info->zoned_meta_io_lock across the whole\nwriteback loop, including the call to btrfs_check_meta_write_pointer() ->\ncheck_bg_is_active().\n\nFor the tree-log block group, check_bg_is_active() may fail to activate\nthe zone and fall back to btrfs_zone_finish_one_bg() to free an active\nzone. That path waits for the running transaction to commit while still\nholding zoned_meta_io_lock, but the committer needs that same lock to\nwrite out the tree extents, so the two tasks deadlock:\n\n  Task A (kworker, metadata writeback)      Task B (fsstress, transaction commit)\n  ------------------------------------      -------------------------------------\n  wb_workfn()                               btrfs_commit_transaction(T)\n   btree_writepages()                        btrfs_write_and_wait_transaction()\n    btrfs_zoned_meta_io_lock()                btrfs_write_marked_extents()\n    btrfs_check_meta_write_pointer()           btree_writepages()\n     check_bg_is_active() [treelog_bg]          btrfs_zoned_meta_io_lock()\n      btrfs_zone_finish_one_bg()               <blocks on zoned_meta_io_lock,\n       btrfs_zone_finish()                      held by Task A>\n        do_zone_finish()\n         btrfs_inc_block_group_ro()\n          btrfs_wait_for_commit()\n           <blocks waiting for commit\n            of transaction T, done by\n            Task B>\n\nThe sibling branch in check_bg_is_active() already drops zoned_meta_io_lock\naround do_zone_finish() for this exact reason. Do the same in the tree-log\nbranch: release the lock around btrfs_zone_finish_one_bg() and re-acquire\nit afterwards. The lock only protects fs_info->active_{meta,system}_bg,\nwhich this branch does not touch, and ctx->zoned_bg keeps a reference to\nthe block group across the unlock, so nothing is lost while the lock\nis dropped.\n\nThis hang occasionally reproduces with fstests generic/475 on a zoned\nbtrfs filesystem."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/zoned.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"13bb483d32abb6f8ebd40141d87eb68f11cc2dd2","lessThan":"18577e77c2c8adaadf1f7c6e9bcd1c0b14e5dcdd","versionType":"git","status":"affected"},{"version":"13bb483d32abb6f8ebd40141d87eb68f11cc2dd2","lessThan":"c3320873e0c04ce7b746fc8fe948f07bbbbdec33","versionType":"git","status":"affected"},{"version":"13bb483d32abb6f8ebd40141d87eb68f11cc2dd2","lessThan":"deddd28fd83c264ee2ff5cd6b34449a9f1be6112","versionType":"git","status":"affected"},{"version":"13bb483d32abb6f8ebd40141d87eb68f11cc2dd2","lessThan":"75859a7cd77cd2ddaddbcb963e3fcd34738953af","versionType":"git","status":"affected"},{"version":"13bb483d32abb6f8ebd40141d87eb68f11cc2dd2","lessThan":"1ebe51c29fa9755d5b2fea28727c051117907cf8","versionType":"git","status":"affected"},{"version":"fca3a1cd3ba47f1815e0c0fcdc9aafaf02ee0a75","versionType":"git","status":"affected"},{"version":"6.5.5","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/zoned.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/18577e77c2c8adaadf1f7c6e9bcd1c0b14e5dcdd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ebe51c29fa9755d5b2fea28727c051117907cf8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75859a7cd77cd2ddaddbcb963e3fcd34738953af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3320873e0c04ce7b746fc8fe948f07bbbbdec33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deddd28fd83c264ee2ff5cd6b34449a9f1be6112","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74573","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:02.963","lastModified":"2026-08-17T06:19:55.640","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE\n\narm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID\ntaken from master->streams[0], assuming a device has exactly one stream. A\ndevice with several streams gets only its first one mapped, so a guest vSID\ninvalidation cannot reach the others' ATC and IOTLB entries; a device with\nnone makes master->streams a ZERO_SIZE_PTR, read out of bounds.\n\nAdd an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP\nwhen master->num_streams is not one, rather than mapping it silently."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d68beb276ba26cec47350a6d468e967673ee0c56","lessThan":"3808bab5d95ae79e333e11f6a73d178e084c645d","versionType":"git","status":"affected"},{"version":"d68beb276ba26cec47350a6d468e967673ee0c56","lessThan":"0acbc621341aca4eb94d9c2f43e1ab273ff088f0","versionType":"git","status":"affected"},{"version":"d68beb276ba26cec47350a6d468e967673ee0c56","lessThan":"c3b8ee84a965058b41275069d4696f37a8b14bf6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/0acbc621341aca4eb94d9c2f43e1ab273ff088f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3808bab5d95ae79e333e11f6a73d178e084c645d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3b8ee84a965058b41275069d4696f37a8b14bf6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74574","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:03.063","lastModified":"2026-08-17T06:19:55.750","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()\n\nThe failed_dev_add and failed_dev_name paths drop the file-device\nreference while wq->wq_lock is still held. If put_device(fdev) drops the\nlast reference, idxd_file_dev_release() runs synchronously and tries to\ntake wq->wq_lock again, deadlocking.\n\nThose paths also fall through into the later ctx cleanup labels even\nthough idxd_file_dev_release() owns that cleanup and frees ctx. This can\nmake idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.\n\nMove idxd_wq_get() before file-device setup can fail, since the release\ncallback always calls idxd_wq_put(). Then unlock wq->wq_lock before\nput_device(fdev) and return directly from the file-device setup failure\npath, leaving ctx cleanup to the release callback."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma/idxd/cdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec","lessThan":"778ccbded2c8749c5be7f0dfa04fc9977a36fb7e","versionType":"git","status":"affected"},{"version":"e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec","lessThan":"8d5d28285728be47c82fdf1c48be4268293c90e7","versionType":"git","status":"affected"},{"version":"e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec","lessThan":"0679c0c189d2548f00e1bac95be28e2df5c6c7f7","versionType":"git","status":"affected"},{"version":"e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec","lessThan":"6e26a41c4c1a706edaaa7c7dffc6b3b945707a55","versionType":"git","status":"affected"},{"version":"e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec","lessThan":"ee1d7274102285d78a53161fc705a8d8cd40b066","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma/idxd/cdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0679c0c189d2548f00e1bac95be28e2df5c6c7f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e26a41c4c1a706edaaa7c7dffc6b3b945707a55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/778ccbded2c8749c5be7f0dfa04fc9977a36fb7e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d5d28285728be47c82fdf1c48be4268293c90e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee1d7274102285d78a53161fc705a8d8cd40b066","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74575","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:03.173","lastModified":"2026-08-23T13:16:45.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Prevent XDomain delayed work use-after-free on disconnect\n\ntb_xdp_handle_request() runs on system_wq and queues\nxd->state_work via queue_delayed_work() in three request handlers:\nPROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake),\nand LINK_STATE_CHANGE_REQUEST.  Similarly, update_xdomain() queues\nxd->properties_changed_work when local properties change.\n\nConcurrently, tb_xdomain_remove() calls stop_handshake() which does\ncancel_delayed_work_sync() on both delayed works.  Later,\ntb_xdomain_unregister() calls device_unregister() which eventually\nfrees the xdomain.  Since commit 559c1e1e0134 (\"thunderbolt: Run\ntb_xdp_handle_request() in system workqueue\") moved the request\nhandler off tb->wq, the handler and the remove path are no longer\nserialized.  If queue_delayed_work() executes after\ncancel_delayed_work_sync() but before the xdomain is freed, the\ndelayed work fires on a freed object.\n\nAdd xd->removing that tb_xdomain_remove() sets under xd->lock\nbefore calling stop_handshake().  Each external queue site holds\nthe same lock and checks removing before calling\nqueue_delayed_work().  This provides the mutual exclusion needed:\neither the queue site acquires the lock first and queues work that\nthe subsequent cancel will see, or the remove path acquires the\nlock first and the queue site observes removing == true and skips\nthe queue."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thunderbolt/xdomain.c","include/linux/thunderbolt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"d4fa0d544c04dea636bf821ff5582cd7d63e2c34","versionType":"git","status":"affected"},{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"cfbd2dba3d862c9be8c92bea2a357d9ed828a54a","versionType":"git","status":"affected"},{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"dc11d5118f9da6ea28487ffe055de5a0d0734125","versionType":"git","status":"affected"},{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"91b40862a02000f490b63f1d315be3ee31e83871","versionType":"git","status":"affected"},{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"33c0ee18cf8665c974b00f4e0ba769fbc07efe10","versionType":"git","status":"affected"},{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"54a62153c765cd24239cde1f2633f2a2fd005368","versionType":"git","status":"affected"},{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91","versionType":"git","status":"affected"},{"version":"559c1e1e013437bf190469efbcbd8bc803285853","lessThan":"2c5d2d3c3f70cde2565d7b279b544893a2035842","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thunderbolt/xdomain.c","include/linux/thunderbolt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2aa2cde2cc79a79d8ea4a15be9f4a67fc528ae91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c5d2d3c3f70cde2565d7b279b544893a2035842","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33c0ee18cf8665c974b00f4e0ba769fbc07efe10","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54a62153c765cd24239cde1f2633f2a2fd005368","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91b40862a02000f490b63f1d315be3ee31e83871","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfbd2dba3d862c9be8c92bea2a357d9ed828a54a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4fa0d544c04dea636bf821ff5582cd7d63e2c34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc11d5118f9da6ea28487ffe055de5a0d0734125","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74576","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:03.290","lastModified":"2026-08-17T06:19:56.017","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: prevent unbounded recursion in free path with new kmalloc type\n\nCommit 280ea9c3154b (\"mm/slab: avoid allocating slabobj_ext array from\nits own slab\") avoided recursive allocation of obj_exts from kmalloc\ncaches of the same size, by bumping the obj_exts array's allocation\nsize whenever the array size equals the size of the object being\nallocated.\n\nHowever, as reported by Danielle Costantino and Shakeel Butt,\neven slabs from kmalloc caches of different sizes can form a cycle\nby allocating obj_exts arrays from each other [1]:\n\n  What happened: a KMALLOC_NORMAL slab's obj_exts array (used by\n  allocation profiling / memcg accounting) is itself kmalloc()'d from a\n  KMALLOC_NORMAL cache, so the \"slab holds another slab's obj_exts array\"\n  relation can form cycles. With sizeof(struct slabobj_ext) == 16 and\n  the host's geometry:\n\n  - kmalloc-512 has 64 objects/slab -> array is 64*16 == 1024 bytes,\n    served from kmalloc-1k;\n  - kmalloc-1k  has 32 objects/slab -> array is 32*16 ==  512 bytes,\n    served from kmalloc-512.\n\n  A kmalloc-512 slab and a kmalloc-1k slab therefore hold each other's\n  obj_exts array.  Discarding one frees the other's array, which empties\n  and discards that slab, which frees the first's array, and so on:\n  __free_slab() -> free_slab_obj_exts() -> kfree() -> discard_slab() ->\n  __free_slab() recurses along the cycle until the stack is exhausted.\n\nWith memory allocation profiling, this allows unbounded recursion\nin the free path and led to a stack overflow on a production host in\nthe Meta fleet [1]:\n\n  BUG: TASK stack guard page was hit\n  Oops: stack guard page\n  RIP: 0010:kfree+0x8/0x5d0\n  Call Trace:\n   __free_slab+0x66/0xc0\n   kfree+0x3f0/0x5d0\n   ... ( ~125x __free_slab <-> kfree ) ...\n   <kernel driver freeing a resource>\n   do_syscall_64\n\nIt is proposed [1] to resolve this issue by always serving the obj_exts\narray allocation from kmalloc caches (or large kmalloc) of sizes larger\nthan the object size. However, as pointed out by Vlastimil Babka [2],\nthis can waste an excessive amount of memory as slabs from large\nkmalloc sizes (e.g. kmalloc-8k) generally need obj_exts arrays much\nsmaller than the object size.\n\nTherefore, rather than bumping the size, let us take a different\napproach; disallow formation of cycles between kmalloc types when\nallocating obj_exts arrays. Currently, all obj_exts arrays are served\nfrom normal kmalloc caches. Cycles cannot be created if obj_exts arrays\nof normal kmalloc caches are served from a special kmalloc type that can\nnever have obj_exts arrays.\n\nTo achieve this, create a new kmalloc type called KMALLOC_NO_OBJ_EXT.\nKMALLOC_NO_OBJ_EXT caches are created with SLAB_NO_OBJ_EXT flag when\neither 1) memory allocation profiling is not permanently disabled,\nor 2) kmalloc types with a priority higher than KMALLOC_CGROUP are\naliased with KMALLOC_NORMAL.\n\nSheaf bootstrapping for KMALLOC_NO_OBJ_EXT caches now must be deferred\nbecause allocation of a barn can trigger obj_exts array allocation of\nnormal kmalloc caches when the KMALLOC_NO_OBJ_EXT cache for that size\nis not ready yet. For simplicity, perform bootstrapping of sheaves for\nall kmalloc caches later.\n\nIntroduce a new slab alloc flag, SLAB_ALLOC_NO_OBJ_EXT, to prevent\nallocation of obj_exts arrays, and let kmalloc_slab() override the type\nto KMALLOC_NO_OBJ_EXT when specified. Note that kmalloc_type() remains\nunchanged because kmalloc_flags() bypasses the kmalloc fastpath.\n\nDo not pass SLAB_ALLOC_NO_RECURSE to kmalloc_flags() in\nalloc_slab_obj_exts() and instead use SLAB_ALLOC_NO_OBJ_EXT only when\nthe objects are allocated from normal kmalloc caches. While this\nprevents unbounded recursive allocation of obj_exts, it allows\nKMALLOC_NO_OBJ_EXT caches to have sheaves.\n\nSince sheaf allocations specify SLAB_ALLOC_NO_RECURSE that prevents\nallocation of both sheaves and obj_exts arrays, the recursion depth\nis bounded.\n\nobj_exts arrays for non-\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/slab.h","mm/slab.h","mm/slab_common.c","mm/slub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4b8736964640fe160724e7135dc62883bddcdace","lessThan":"3e71bfbdd3fd81ee9fefd867fdb2be62bade4140","versionType":"git","status":"affected"},{"version":"4b8736964640fe160724e7135dc62883bddcdace","lessThan":"d01e88d421a6d07f35235600a43fbd0e551cf292","versionType":"git","status":"affected"},{"version":"4b8736964640fe160724e7135dc62883bddcdace","lessThan":"ebefca49e4c69df24ba9307bfe0806230301d5c6","versionType":"git","status":"affected"},{"version":"4b8736964640fe160724e7135dc62883bddcdace","lessThan":"d9e6a7623938968e3752b67e37eaff097e559a54","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/slab.h","mm/slab.h","mm/slab_common.c","mm/slub.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/3e71bfbdd3fd81ee9fefd867fdb2be62bade4140","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d01e88d421a6d07f35235600a43fbd0e551cf292","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9e6a7623938968e3752b67e37eaff097e559a54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebefca49e4c69df24ba9307bfe0806230301d5c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-74577","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-08-15T13:18:03.430","lastModified":"2026-08-19T17:21:11.870","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: initialize rtm_tos in mpls_getroute()\n\nmpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE\nrequest by filling a struct rtmsg allocated from an skb whose data\narea is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every\nfield of the header except rtm_tos:\n\n\tr = nlmsg_data(nlh);\n\tr->rtm_family\t = AF_MPLS;\n\tr->rtm_dst_len\t= 20;\n\tr->rtm_src_len\t= 0;\n\tr->rtm_table\t= RT_TABLE_MAIN;\n\tr->rtm_type\t= RTN_UNICAST;\n\tr->rtm_scope\t= RT_SCOPE_UNIVERSE;\n\tr->rtm_protocol = rt->rt_protocol;\n\tr->rtm_flags\t= 0;\n\nstruct rtmsg has no padding, so the one uninitialised byte rtm_tos\n(offset 3) is copied straight to user space on recvmsg(), leaking a\nbyte of uninitialised heap memory. This is in contrast to\nmpls_dump_route(), which fills the very same header and does set\nrtm_tos = 0.\n\nInitialize rtm_tos to 0, matching mpls_dump_route().\n\nReproduced with KMSAN by adding an MPLS route and issuing a\nnon-RTM_F_FIB_MATCH RTM_GETROUTE for its label:\n\n  BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0\n   _copy_to_iter+0x36c/0x33f0\n   __skb_datagram_iter+0x196/0x12c0\n   skb_copy_datagram_iter+0x5b/0x210\n   netlink_recvmsg+0x37b/0xef0\n   ...\n  Uninit was created at:\n   __alloc_skb+0x8ca/0x10e0\n   mpls_getroute+0x1280/0x3a40\n   rtnetlink_rcv_msg+0x1138/0x15a0\n   ...\n  Byte 19 of 64 is uninitialized\n\n(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mpls/af_mpls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1","versionType":"git","status":"affected"},{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"466b474a8deb0c93b5280c6d261e5eda6482eca7","versionType":"git","status":"affected"},{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"ba56f88aab18d982f2a21f11390f4d8a8897782a","versionType":"git","status":"affected"},{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"95651461cf77cc6590fa08c87667717e5dcfa55d","versionType":"git","status":"affected"},{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"1fea5ff0eb4aa7e951bb3d380248566c473aa377","versionType":"git","status":"affected"},{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"a5cdd2407dd890f741f59b8367e4c6c101cce154","versionType":"git","status":"affected"},{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"2dc2fffc704a4365cae1aae078ba62223aaeff93","versionType":"git","status":"affected"},{"version":"397fc9e5cefee0c33b86811fbddb0decb7288c52","lessThan":"295dd295e2137e10e9a5b1891d97e0f08de76f03","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mpls/af_mpls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1fea5ff0eb4aa7e951bb3d380248566c473aa377","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/295dd295e2137e10e9a5b1891d97e0f08de76f03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2dc2fffc704a4365cae1aae078ba62223aaeff93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/466b474a8deb0c93b5280c6d261e5eda6482eca7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95651461cf77cc6590fa08c87667717e5dcfa55d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5cdd2407dd890f741f59b8367e4c6c101cce154","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba56f88aab18d982f2a21f11390f4d8a8897782a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-15689","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-08-15T14:17:06.480","lastModified":"2026-08-26T16:51:19.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send.\n\nBoth default emails emit a link of the form `$base/login/$code`, whose authority comes from the request Host header, or from X-Forwarded-Host under behind_proxy (obtained from Dancer2's request->base function). A POST to /login carrying submit_reset and a username needs no authentication: it stores a fresh reset code against that account and mails the account holder a link to a host of the sender's choosing. The welcome mail takes the same path when the application calls create_user with email_welcome set.\n\nThrough 0.711 the handlers read `request->uri_base` and `request->base` directly; Versions 0.712 and later provide an uri_base configuration key that defaults to the untrusted `request->uri_base` when unset.\n\nThe default configuration with reset_password_handler enabled and the default message text, a recipient who follows the link hands a working reset code to the sender's host, which is enough to take over the account."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"vendor":"ABEVERLEY","product":"Dancer2::Plugin::Auth::Extensible","defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Dancer2-Plugin-Auth-Extensible","programFiles":["lib/Dancer2/Plugin/Auth/Extensible.pm"],"programRoutines":[{"name":"Dancer2::Plugin::Auth::Extensible::_default_email_password_reset"},{"name":"Dancer2::Plugin::Auth::Extensible::_default_welcome_send"},{"name":"Dancer2::Plugin::Auth::Extensible::password_reset_send"}],"repo":"https://github.com/PerlDancer/Dancer2-Plugin-Auth-Extensible","versions":[{"version":"0","lessThanOrEqual":"0.713","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:27:20.766989Z","id":"CVE-2026-15689","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-640"}]}],"references":[{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.711/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L1031-1053","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.711/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L1097-1121","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.712/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L178-194","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.713/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/ABEVERLEY/Dancer2-Plugin-Auth-Extensible-0.713/source/lib/Dancer2/Plugin/Auth/Extensible.pm#L178-196","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/15/4","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-18165","sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","published":"2026-08-15T14:17:07.290","lastModified":"2026-08-28T19:46:29.323","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow. Any party able to write a cookie for the application's host, such as a sibling subdomain under the same registrable domain, can plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser, silently signing the victim in to the attacker's account (login CSRF). It does not expose the victim's own account, credentials, or tokens. The issue is fixed in @fastify/oauth2 8.3.0, which adds an opt-in hostPrefixedCookies option. Users should upgrade to 8.3.0 and enable it, or bind state to a server-side session."}],"affected":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","affectedData":[{"vendor":"@fastify/oauth2","product":"@fastify/oauth2","defaultStatus":"unaffected","packageURL":"pkg:npm/@fastify/oauth2","versions":[{"version":"7.2.0","lessThan":"8.3.0","versionType":"semver","status":"affected"},{"version":"8.3.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:41:41.954802Z","id":"CVE-2026-18165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"url":"https://github.com/fastify/fastify-oauth2/security/advisories/GHSA-p8h8-rj28-m8q9","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}]}},{"cve":{"id":"CVE-2026-18500","sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","published":"2026-08-15T14:17:07.473","lastModified":"2026-08-28T19:46:29.323","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another key. This lets an ordinary authenticated user cross a key-based trust boundary without knowing either secret. The issue is fixed in @fastify/jwt 10.2.2, where an explicit per-call key takes precedence over the global secret. Users should upgrade to 10.2.2."}],"affected":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","affectedData":[{"vendor":"@fastify/jwt","product":"@fastify/jwt","defaultStatus":"unaffected","packageURL":"pkg:npm/@fastify/jwt","versions":[{"version":"0","lessThan":"10.2.2","versionType":"semver","status":"affected"},{"version":"10.2.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:45:28.953645Z","id":"CVE-2026-18500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"url":"https://github.com/fastify/fastify-jwt/security/advisories/GHSA-j4cx-787j-xjqg","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}]}},{"cve":{"id":"CVE-2026-18549","sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","published":"2026-08-15T14:17:07.590","lastModified":"2026-08-28T19:46:29.323","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1."}],"affected":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","affectedData":[{"vendor":"@fastify/multipart","product":"@fastify/multipart","defaultStatus":"unaffected","packageURL":"pkg:npm/@fastify/multipart","versions":[{"version":"5.3.0","lessThan":"10.1.1","versionType":"semver","status":"affected"},{"version":"10.1.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:43:46.284783Z","id":"CVE-2026-18549","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-664"}]}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"url":"https://github.com/fastify/fastify-multipart/security/advisories/GHSA-vmph-573x-85f6","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}]}},{"cve":{"id":"CVE-2026-19474","sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","published":"2026-08-15T14:17:07.710","lastModified":"2026-08-28T19:46:29.323","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1."}],"affected":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","affectedData":[{"vendor":"@fastify/multipart","product":"@fastify/multipart","defaultStatus":"unaffected","packageURL":"pkg:npm/@fastify/multipart","versions":[{"version":"3.0.0","lessThan":"10.1.1","versionType":"semver","status":"affected"},{"version":"10.1.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:43:01.292598Z","id":"CVE-2026-19474","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","description":[{"lang":"en","value":"CWE-459"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},{"url":"https://github.com/fastify/fastify-multipart/security/advisories/GHSA-62qx-hpj5-j6hc","source":"ce714d77-add3-4f53-aff5-83d477b104bb"}]}},{"cve":{"id":"CVE-2026-19895","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T14:17:07.840","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"opensourcepos","product":"Open Source Point of Sale","cpes":["cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*"],"modules":["Login Endpoint"],"versions":[{"version":"3.4.0","status":"affected"},{"version":"3.4.1","status":"affected"},{"version":"3.4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:41:28.137293Z","id":"CVE-2026-19895","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://github.com/opensourcepos/opensourcepos/issues/4583","source":"cna@vuldb.com"},{"url":"https://github.com/purnadika/opensourcepos/commit/851fc323e517e798b3872a2fa54d2923b85fe04c","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19895","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870664","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390085","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390085/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19896","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T15:16:37.507","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mangroup","product":"dtale","cpes":["cpe:2.3:a:mangroup:dtale:*:*:*:*:*:*:*:*"],"modules":["Flask Session Cookie"],"versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"},{"version":"3.4","status":"affected"},{"version":"3.5","status":"affected"},{"version":"3.6","status":"affected"},{"version":"3.7","status":"affected"},{"version":"3.8","status":"affected"},{"version":"3.9","status":"affected"},{"version":"3.10","status":"affected"},{"version":"3.11","status":"affected"},{"version":"3.12","status":"affected"},{"version":"3.13","status":"affected"},{"version":"3.14","status":"affected"},{"version":"3.15","status":"affected"},{"version":"3.16","status":"affected"},{"version":"3.17","status":"affected"},{"version":"3.18","status":"affected"},{"version":"3.19","status":"affected"},{"version":"3.20","status":"affected"},{"version":"3.21","status":"affected"},{"version":"3.22.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:19:05.809749Z","id":"CVE-2026-19896","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-310"},{"lang":"en","value":"CWE-330"}]}],"references":[{"url":"https://github.com/man-group/dtale/issues/960","source":"cna@vuldb.com"},{"url":"https://github.com/man-group/dtale/pull/963","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19896","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870672","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390086","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390086/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19897","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T16:16:38.680","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"mangroup","product":"dtale","cpes":["cpe:2.3:a:mangroup:dtale:*:*:*:*:*:*:*:*"],"modules":["Login Endpoint"],"versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"},{"version":"3.4","status":"affected"},{"version":"3.5","status":"affected"},{"version":"3.6","status":"affected"},{"version":"3.7","status":"affected"},{"version":"3.8","status":"affected"},{"version":"3.9","status":"affected"},{"version":"3.10","status":"affected"},{"version":"3.11","status":"affected"},{"version":"3.12","status":"affected"},{"version":"3.13","status":"affected"},{"version":"3.14","status":"affected"},{"version":"3.15","status":"affected"},{"version":"3.16","status":"affected"},{"version":"3.17","status":"affected"},{"version":"3.18","status":"affected"},{"version":"3.19","status":"affected"},{"version":"3.20","status":"affected"},{"version":"3.21","status":"affected"},{"version":"3.22.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:49:56.174937Z","id":"CVE-2026-19897","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://github.com/man-group/dtale/issues/961","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19897","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870673","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390087","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390087/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19898","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T16:16:39.230","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 1.147.0 is recommended to address this issue. The patch is named 119ba0fb5be8024d50c5ba946599b2e69e8803ea. Upgrading the affected component is recommended."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"VictoriaMetrics","cpes":["cpe:2.3:a:victoriametrics:victoriametrics:*:*:*:*:*:*:*:*"],"modules":["VMAuth Authentication Endpoint"],"versions":[{"version":"1.146","status":"affected"},{"version":"1.147.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T13:24:36.332845Z","id":"CVE-2026-19898","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://github.com/VictoriaMetrics/VictoriaMetrics/","source":"cna@vuldb.com"},{"url":"https://github.com/VictoriaMetrics/VictoriaMetrics/commit/119ba0fb5be8024d50c5ba946599b2e69e8803ea","source":"cna@vuldb.com"},{"url":"https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180","source":"cna@vuldb.com"},{"url":"https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.147.0","source":"cna@vuldb.com"},{"url":"https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-c7pm-322g-r9gf","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870679","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390088","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390088/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19899","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T17:16:23.977","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Class and Exam Timetabling System","cpes":["cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-19T15:51:14.027889Z","id":"CVE-2026-19899","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/endingstory/e/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19899","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870682","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390089","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390089/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19900","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T17:16:24.730","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"LB-LINK","product":"X-PRO","cpes":["cpe:2.3:a:lb-link:x-pro:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.22-20231206","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:C/I:C/A:C","baseScore":7.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":4.9,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:40:30.398547Z","id":"CVE-2026-19900","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-259"},{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://github.com/DavCloudz/cve/blob/main/B-Link/B-Link%20AC1200%20X-PRO(AC6)%20Hardcoded%20Credentials%20Vulnerability.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19900","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870712","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390090","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390090/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19598","sourceIdentifier":"security@wordfence.com","published":"2026-08-15T18:16:23.860","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective.  This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"sc0ttkclark","product":"Pods – Custom Content Types and Fields","defaultStatus":"unaffected","versions":[{"version":"2.8","lessThanOrEqual":"2.8.23.3","versionType":"semver","status":"affected"},{"version":"2.9","lessThanOrEqual":"2.9.19.3","versionType":"semver","status":"affected"},{"version":"3.0","lessThanOrEqual":"3.0.10.3","versionType":"semver","status":"affected"},{"version":"3.1","lessThanOrEqual":"3.1.4.1","versionType":"semver","status":"affected"},{"version":"3.2","lessThanOrEqual":"3.2.8.2","versionType":"semver","status":"affected"},{"version":"3.3","lessThanOrEqual":"3.3.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:49:11.035762Z","id":"CVE-2026-19598","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/pods/tags/3.3.9/includes/general.php#L400","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3628032a-3121-45a7-8a78-cfcd8ba6af2f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19901","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T18:16:24.830","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"LB-LINK","product":"X-PRO","cpes":["cpe:2.3:a:lb-link:x-pro:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.22-20231206","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:C/I:C/A:C","baseScore":7.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":4.9,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:19:50.496736Z","id":"CVE-2026-19901","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-259"},{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://github.com/DavCloudz/cve/blob/main/B-Link/Hardcoded%20TR-069%20(easycwmp)%20Remote%20Management%20Credentials.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19901","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870763","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390091","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390091/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19903","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T18:16:25.000","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Clothing Store","cpes":["cpe:2.3:a:sourcecodester:online_clothing_store:*:*:*:*:*:*:*:*"],"modules":["SQL Database Backup"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:44:42.799446Z","id":"CVE-2026-19903","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-425"},{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19903","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870782","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390096","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390096/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"},{"url":"https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-19904","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T18:16:25.183","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Book Store System","cpes":["cpe:2.3:a:sourcecodester:online_book_store_system:*:*:*:*:*:*:*:*"],"modules":["System Settings Module"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N","baseScore":2.4,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N","baseScore":3.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T13:24:33.571323Z","id":"CVE-2026-19904","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-system-settings-module-fa4f99ed1544","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19904","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870786","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390097","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390097/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-18855","sourceIdentifier":"security@wordfence.com","published":"2026-08-15T19:16:32.160","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jackdewey","product":"Link Library","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.9.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:16:22.098909Z","id":"CVE-2026-18855","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/link-library/tags/7.9.4/link-library-admin.php#L7865","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/link-library/tags/7.9.4/link-library-admin.php#L7874","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/link-library/tags/7.9.4/link-library.php#L2288","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/link-library/tags/7.9.4/usersubmission.php#L476","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/link-library/tags/7.9.4/usersubmission.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3646360/link-library/trunk/link-library-admin.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Flink-library/tags/7.9.4&new_path=%2Flink-library/tags/7.9.5","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3646361%40link-library%2Ftags%2F7.9.5&old=3626573%40link-library%2Ftags%2F7.9.4","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41327dfa-db64-476a-a263-7bd4f69fb857?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19905","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T19:16:32.300","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Jinher","product":"OA","cpes":["cpe:2.3:a:jinher:oa:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-19T15:42:37.197648Z","id":"CVE-2026-19905","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/pangdudu24/cve/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19905","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870787","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390110","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390110/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19906","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T19:16:32.470","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"pkp","product":"pkp-lib","cpes":["cpe:2.3:a:pkp:pkp-lib:*:*:*:*:*:*:*:*"],"modules":["API Key Generation"],"versions":[{"version":"3.3.0","status":"affected"},{"version":"3.4.0","status":"affected"},{"version":"3.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:39:37.281230Z","id":"CVE-2026-19906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-330"},{"lang":"en","value":"CWE-331"}]}],"references":[{"url":"https://github.com/pkp/pkp-lib/","source":"cna@vuldb.com"},{"url":"https://github.com/pkp/pkp-lib/commit/529b5df878e571ccc727647f7748eafc1466b041","source":"cna@vuldb.com"},{"url":"https://github.com/pkp/pkp-lib/issues/12951","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19906","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870828","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390119","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390119/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19916","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T22:16:52.850","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Online Food Order System","cpes":["cpe:2.3:a:code-projects:online_food_order_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:22:45.449989Z","id":"CVE-2026-19916","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/zzzxc643/CVE1/blob/main/project1/vul6.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19916","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870863","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390166","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390166/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-73041","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:53.883","lastModified":"2026-08-26T17:05:08.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:35:53.314697Z","id":"CVE-2026-73041","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqpw-c3pj-w8g9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-pdf-annotations","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqpw-c3pj-w8g9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73042","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:54.030","lastModified":"2026-08-26T16:57:52.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:57:49.411534Z","id":"CVE-2026-73042","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm3-qcq3-72rv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-menu-metadata","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-73043","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:54.200","lastModified":"2026-08-26T16:57:52.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:48:38.843800Z","id":"CVE-2026-73043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rwh7-gm74-67h6","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-template-calculation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-73044","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:54.330","lastModified":"2026-08-26T17:04:11.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T18:34:55.310118Z","id":"CVE-2026-73044","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rj55-w3xr-gj62","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-stored-cross-site-scripting-via-column-width","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rj55-w3xr-gj62","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73045","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:54.463","lastModified":"2026-08-26T17:04:11.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:20:50.838906Z","id":"CVE-2026-73045","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-brute-force-via-authfilepublishaccess","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73046","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:54.600","lastModified":"2026-08-26T17:05:08.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:32:32.674625Z","id":"CVE-2026-73046","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3xh-mmmh-r54v","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-http-basic-auth","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3xh-mmmh-r54v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73047","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:54.737","lastModified":"2026-08-26T16:57:52.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:57:43.147497Z","id":"CVE-2026-73047","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v97v-gxxg-rhmq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-server-side-template-injection-via-attribute-view","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-73050","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:54.870","lastModified":"2026-08-26T16:57:52.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:43:42.714023Z","id":"CVE-2026-73050","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-m7cc-jh9q-wxg8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-stored-xss-via-select-option-color","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-m7cc-jh9q-wxg8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73052","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:55.017","lastModified":"2026-08-26T17:05:08.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T18:00:07.050737Z","id":"CVE-2026-73052","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g3jx-227v-x2x4","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-stored-xss-via-attribute-view-field-names","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g3jx-227v-x2x4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73053","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:55.157","lastModified":"2026-08-26T17:04:11.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:21:43.098714Z","id":"CVE-2026-73053","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vx5w-qrvp-mmcq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-cross-site-scripting-via-unicode2emoji","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vx5w-qrvp-mmcq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73054","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:55.290","lastModified":"2026-08-26T17:05:08.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","versions":[{"version":"0","lessThan":"3.7.4","versionType":"semver","status":"affected"},{"version":"3.7.4","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:24:10.357302Z","id":"CVE-2026-73054","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-websocket","source":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8w8-3pqp-wr83","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-73055","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-15T22:16:55.427","lastModified":"2026-08-31T15:17:43.303","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to \"sh\" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ericcornelissen","product":"shescape","defaultStatus":"unaffected","collectionURL":"https://github.com/ericcornelissen/shescape","repo":"https://github.com/ericcornelissen/shescape","packageURL":"pkg:npm/shescape","versions":[{"version":"0","lessThan":"2.1.15","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T16:00:56.475269Z","id":"CVE-2026-73055","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/ericcornelissen/shescape/commit/7cba30594c16a21524706efe2f6c6c9d8923f411","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ericcornelissen/shescape/commit/d86bf2ae22961c73458bddf70dd06adf9dadb36c","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j44h-fqhh-fh28","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/shescape-before-home-directory-disclosure-via-busybox","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-74764","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-08-15T22:16:55.563","lastModified":"2026-08-26T16:49:35.390","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.\n\n\nAn attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process.\n\n\nThe vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets. \n\n\nThe weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"pandora-analysis","product":"pandora","defaultStatus":"unaffected","repo":"https://github.com/pandora-analysis/pandora","versions":[{"version":"0","lessThanOrEqual":"1.12.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:40:44.438035Z","id":"CVE-2026-74764","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/pandora-analysis/pandora/commit/186b58d41e04248a154d274fffb5813e7fa2012e","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-74767","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-08-15T22:16:55.697","lastModified":"2026-08-26T16:49:35.390","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data.\n\n\nAn attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service.\n\n\nThe patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"pandora-analysis","product":"pandora","defaultStatus":"unaffected","repo":"https://github.com/pandora-analysis/pandora/","versions":[{"version":"0","lessThanOrEqual":"1.12.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:40:03.205738Z","id":"CVE-2026-74767","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/pandora-analysis/pandora/commit/f4294a873f86fbf2569c289e329fff2f52ca50c9","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-19917","sourceIdentifier":"cna@vuldb.com","published":"2026-08-15T23:16:20.913","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Online Food Order System","cpes":["cpe:2.3:a:code-projects:online_food_order_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:47:06.695542Z","id":"CVE-2026-19917","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/zzzxc643/CVE1/blob/main/project1/vul7.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19917","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870865","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390167","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390167/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19918","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T00:16:50.180","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SpaceX","product":"Starlink Router Gen 3","cpes":["cpe:2.3:h:spacex:starlink_router_gen_3:*:*:*:*:*:*:*:*"],"modules":["gRPC Management Interface"],"versions":[{"version":"2025.11.14.mr64708.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:P/I:P/A:P","baseScore":5.8,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.5,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T13:24:31.436540Z","id":"CVE-2026-19918","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-19918","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/870897","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390168","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390168/cti","source":"cna@vuldb.com"},{"url":"https://www.ararasat.com/blog/starlink-lan-grpc-control/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19919","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T00:16:50.360","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Online Shopping System","cpes":["cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"],"modules":["Login"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-19T15:10:43.715581Z","id":"CVE-2026-19919","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul1.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19919","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871811","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390169","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390169/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871811","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-19920","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T00:16:50.530","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Online Shopping System","cpes":["cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:22:23.408518Z","id":"CVE-2026-19920","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul2.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19920","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871812","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390170","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390170/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19921","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T00:16:50.687","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction.php. Such manipulation of the argument cat_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Online Shopping System","cpes":["cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:23:31.314883Z","id":"CVE-2026-19921","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul3.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19921","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871813","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390171","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390171/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19922","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T01:17:07.840","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount_1 results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Online Shopping System","cpes":["cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:46:39.705864Z","id":"CVE-2026-19922","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul4.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19922","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871814","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390172","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390172/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19923","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T01:17:08.080","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. Executing a manipulation of the argument total_count can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Online Shopping System","cpes":["cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T13:24:29.228614Z","id":"CVE-2026-19923","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul5.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19923","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871815","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390173","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390173/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19924","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T02:16:47.247","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Tenda","product":"AC10","cpes":["cpe:2.3:o:tenda:ac10_firmware:*:*:*:*:*:*:*:*"],"modules":["httpd"],"versions":[{"version":"16.03.10.09_multi_TDE01","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-19T15:49:55.747146Z","id":"CVE-2026-19924","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/authen-bypass-tenda-ac10.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19924","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871957","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390174","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390174/cti","source":"cna@vuldb.com"},{"url":"https://www.tenda.com.cn/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19925","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T02:16:48.633","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete_supplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Stock Management System","cpes":["cpe:2.3:a:sourcecodester:stock_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:21:25.964233Z","id":"CVE-2026-19925","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/miku01leon/CVE/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19925","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871969","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390175","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390175/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19926","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T02:16:48.790","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Evergreen","cpes":["cpe:2.3:a:evergreen:evergreen:*:*:*:*:*:*:*:*"],"modules":["open-ils.fielder OpenSRF Service"],"versions":[{"version":"3.14.0","status":"affected"},{"version":"3.14.1","status":"affected"},{"version":"3.14.2","status":"affected"},{"version":"3.14.3","status":"affected"},{"version":"3.14.4","status":"affected"},{"version":"3.14.5","status":"affected"},{"version":"3.14.6","status":"affected"},{"version":"3.14.7","status":"affected"},{"version":"3.14.8","status":"affected"},{"version":"3.14.9","status":"affected"},{"version":"3.14.10","status":"affected"},{"version":"3.14.11","status":"affected"},{"version":"3.15.0","status":"affected"},{"version":"3.15.1","status":"affected"},{"version":"3.15.2","status":"affected"},{"version":"3.15.3","status":"affected"},{"version":"3.15.4","status":"affected"},{"version":"3.15.5","status":"affected"},{"version":"3.15.6","status":"affected"},{"version":"3.15.7","status":"affected"},{"version":"3.15.8","status":"affected"},{"version":"3.15.9","status":"affected"},{"version":"3.15.10","status":"affected"},{"version":"3.15.11","status":"affected"},{"version":"3.16.0","status":"affected"},{"version":"3.16.1","status":"affected"},{"version":"3.16.2","status":"affected"},{"version":"3.16.3","status":"affected"},{"version":"3.16.4","status":"affected"},{"version":"3.16.5","status":"affected"},{"version":"3.17-beta1","status":"affected"},{"version":"3.14.12","status":"unaffected"},{"version":"3.15.12","status":"unaffected"},{"version":"3.16.6","status":"unaffected"},{"version":"3.17-beta2","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T02:25:32.117872Z","id":"CVE-2026-19926","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://bugs.launchpad.net/evergreen/+bug/2147196","source":"cna@vuldb.com"},{"url":"https://bugs.launchpad.net/evergreen/+bug/2147196/+attachment/5958185/+files/2.png","source":"cna@vuldb.com"},{"url":"https://evergreen-ils.org/Evergreen-security-release-3-14-12-3-15-12-3-16-6-3-17-beta2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19926","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871976","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390177","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390177/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19927","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T03:16:49.333","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"OpenBoxes","cpes":["cpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:*"],"modules":["Product Upload Endpoint"],"versions":[{"version":"0.9.0","status":"affected"},{"version":"0.9.1","status":"affected"},{"version":"0.9.2","status":"affected"},{"version":"0.9.3","status":"affected"},{"version":"0.9.4","status":"affected"},{"version":"0.9.5","status":"affected"},{"version":"0.9.6","status":"affected"},{"version":"0.9.7","status":"affected"},{"version":"0.9.8-hotfix1","status":"unaffected"},{"version":"0.9.8","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:46:04.069459Z","id":"CVE-2026-19927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/pull/5944","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-828r-3vx8-65wx","source":"cna@vuldb.com"},{"url":"https://github.com/openboxes/openboxes/commit/a599007325efe780a21b3537ecce3ca25635c926","source":"cna@vuldb.com"},{"url":"https://github.com/openboxes/openboxes/releases/tag/v0.9.8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19927","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871980","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390178","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390178/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19928","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T03:16:50.143","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"OpenBoxes","cpes":["cpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:*"],"modules":["Role Interceptor"],"versions":[{"version":"0.9.0","status":"affected"},{"version":"0.9.1","status":"affected"},{"version":"0.9.2","status":"affected"},{"version":"0.9.3","status":"affected"},{"version":"0.9.4","status":"affected"},{"version":"0.9.5","status":"affected"},{"version":"0.9.6","status":"affected"},{"version":"0.9.7","status":"affected"},{"version":"0.9.8-hotfix1","status":"unaffected"},{"version":"0.9.8","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T13:24:27.176747Z","id":"CVE-2026-19928","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://gist.github.com/nedlir/2bc3a6e5bd4d67b863223e1bfc2e4390","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/pull/5948","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-9rrw-fx2p-p2q7","source":"cna@vuldb.com"},{"url":"https://github.com/openboxes/openboxes/commit/788cace0af816aa972a713a4631c57f16f895e6b","source":"cna@vuldb.com"},{"url":"https://github.com/openboxes/openboxes/releases/tag/v0.9.8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19928","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/871981","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390179","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390179/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19929","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T03:16:50.300","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Template Processing. The manipulation leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 will fix this issue. The identifier of the patch is deeac6a4a7aba86ce99c4bda37142e41d209293e. It is recommended to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"OpenBoxes","cpes":["cpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:*"],"modules":["Template Processing"],"versions":[{"version":"0.9.0","status":"affected"},{"version":"0.9.1","status":"affected"},{"version":"0.9.2","status":"affected"},{"version":"0.9.3","status":"affected"},{"version":"0.9.4","status":"affected"},{"version":"0.9.5","status":"affected"},{"version":"0.9.6","status":"affected"},{"version":"0.9.8-hotfix1","status":"unaffected"},{"version":"0.9.8","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-19T15:12:45.965336Z","id":"CVE-2026-19929","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-791"},{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://gist.github.com/nedlir/220a30213b5a5c6bc26d1000012c6a4d","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/pull/5943","source":"cna@vuldb.com"},{"url":"https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-8wxj-vghp-jpcq","source":"cna@vuldb.com"},{"url":"https://github.com/openboxes/openboxes/commit/deeac6a4a7aba86ce99c4bda37142e41d209293e","source":"cna@vuldb.com"},{"url":"https://github.com/openboxes/openboxes/releases/tag/v0.9.8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19929","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/872054","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390180","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390180/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19930","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T04:16:26.747","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 798e65356ede03c2812ab1a728f23fae34de5592. It is advisable to implement a patch to correct this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Dolibarr","cpes":["cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*"],"modules":["User Cloning"],"versions":[{"version":"23.0.0","status":"affected"},{"version":"23.0.1","status":"affected"},{"version":"23.0.2","status":"affected"},{"version":"23.0.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:20:37.649464Z","id":"CVE-2026-19930","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-90"}]}],"references":[{"url":"https://drive.google.com/file/d/1tI3kUdqocvdQwQtqOi5zCFmTMm6eA3sF/view","source":"cna@vuldb.com"},{"url":"https://github.com/Dolibarr/dolibarr/","source":"cna@vuldb.com"},{"url":"https://github.com/Dolibarr/dolibarr/commit/798e65356ede03c2812ab1a728f23fae34de5592","source":"cna@vuldb.com"},{"url":"https://github.com/Dolibarr/dolibarr/issues/39000","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19930","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/872355","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390181","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390181/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-2487","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T04:16:27.943","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"weblizar","product":"Admin Custom Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:19:41.046044Z","id":"CVE-2026-2487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/admin-custom-login/tags/3.6.3/includes/login-form-setting/login-form-background.php#L759","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/admin-custom-login/tags/3.6.3/login-form-screen.php#L162","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/admin-custom-login/trunk/includes/login-form-setting/login-form-background.php#L759","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/admin-custom-login/trunk/login-form-screen.php#L162","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3510948%40admin-custom-login&new=3510948%40admin-custom-login","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e81b6c1-5af5-4ad4-92db-9dba76399857?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2025-10005","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:44.747","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"buildwps","product":"PPWP – Password Protect Pages","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.9.20","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:25.004876Z","id":"CVE-2025-10005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3637624%40password-protect-page&new=3637624%40password-protect-page","source":"security@wordfence.com"},{"url":"https://research.cleantalk.org/CVE-2025-10005","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1850e16-6fac-4d72-9346-ea6280fe84d0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-11780","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:45.643","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question_title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"expresstech","product":"Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"11.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:26:19.250629Z","id":"CVE-2026-11780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.0.0/php/admin/options-page-questions-tab.php#L1557","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.0.0/php/admin/options-page-questions-tab.php#L1580","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.0.0/php/rest-api.php#L301","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.0.0/php/rest-api.php#L741","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.1.4/php/admin/options-page-questions-tab.php#L1557","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.1.4/php/admin/options-page-questions-tab.php#L1580","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.1.4/php/rest-api.php#L301","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.1.4/php/rest-api.php#L741","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3609172%40quiz-master-next&new=3609172%40quiz-master-next","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3612474%40quiz-master-next&new=3612474%40quiz-master-next","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66334c29-c9d6-48b0-8d6b-bae588da0331?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-12477","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:45.810","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpmonks","product":"Gravity Booster – Styles & Layouts for Gravity Forms","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:41:46.139283Z","id":"CVE-2026-12477","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/display/class-styles.php#L147","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/display/class-styles.php#L148","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/display/class-styles.php#L76","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/styles-and-layouts-for-gravity-forms/tags/5.26/includes/admin/fetch/stla-admin-fetch-content-area.php#L290","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3637650%40styles-and-layouts-for-gravity-forms&new=3637650%40styles-and-layouts-for-gravity-forms","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413e5515-6cc9-4fa9-908e-2dc68778f5cb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-12905","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:45.947","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details — including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) — belonging to other staff members by enumerating sequential appointment IDs."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ladela","product":"Online Scheduling and Appointment Booking System – Bookly","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"27.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T14:13:59.539599Z","id":"CVE-2026-12905","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/Ajax.php#L17","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/api/handlers/Handler.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/Ajax.php#L17","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/api/handlers/Handler.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3637918%40bookly-responsive-appointment-booking-tool&new=3637918%40bookly-responsive-appointment-booking-tool","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1600466e-ad45-4dc7-916b-6c97301d2b03?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-13167","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:46.077","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with delegated form management access and above, to activate arbitrary already-installed WordPress plugins — including previously deactivated or vulnerable plugins — without holding the core activate_plugins capability. Exploitation requires the target user to hold a delegated Everest Forms capability (manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms), which the plugin's own roles and permissions tool allows administrators to assign to non-administrator roles such as Author; the nonces required to exploit the AJAX handlers are emitted on EVF admin pages accessible to any such delegated user."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpeverest","product":"Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:17:56.308542Z","id":"CVE-2026-13167","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.5/includes/RestApi/controllers/version1/class-evf-modules.php#L315","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.5/includes/RestApi/controllers/version1/class-evf-modules.php#L730","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.5/includes/class-evf-ajax.php#L121","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.5/includes/class-evf-ajax.php#L1408","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.5/includes/class-evf-ajax.php#L709","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.5.1/includes/RestApi/controllers/version1/class-evf-modules.php#L315","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.5.1/includes/RestApi/controllers/version1/class-evf-modules.php#L730","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.5.1/includes/class-evf-ajax.php#L121","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.5.1/includes/class-evf-ajax.php#L1408","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.5.1/includes/class-evf-ajax.php#L709","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3634069%40everest-forms&new=3634069%40everest-forms","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1ba996-e26c-45cc-ab95-338663f481d9?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-13358","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:46.213","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa_past_appointments due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to access appointment records belonging to arbitrary users and harvest the per-appointment ownership tokens (32-character hashes) embedded in the rendered HTML, which can then be used without any authentication to read or modify those appointments including full customer PII such as name, email, phone number, and private notes. The /wp-json/ssa/v1/render-shortcode REST endpoint is registered unconditionally on rest_api_init regardless of whether the Divi theme is installed, and its permission callback only requires current_user_can('edit_posts'), meaning any Contributor-level account is sufficient to trigger this entire exploit chain."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"croixhaug","product":"Simply Schedule Appointments","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.6.12.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:41.097270Z","id":"CVE-2026-13358","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-appointment-model.php#L1936","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-db-model.php#L325","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-divi.php#L237","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-divi.php#L254","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-shortcodes.php#L781","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-appointment-model.php#L1936","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-db-model.php#L325","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-divi.php#L237","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-divi.php#L254","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-shortcodes.php#L781","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3617759%40simply-schedule-appointments&new=3617759%40simply-schedule-appointments","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbe5094-d255-46b1-9e8e-9c48cd74e8a2?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-14498","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:46.360","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wp_ajax_qw_form_ajax handler, combined with unsanitized attacker-controlled options fully replacing saved query options and being passed directly to call_user_func_array() guarded only by function_exists(). This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. Exploitation requires only that at least one query row exists in the database, as the query_id is a small enumerable integer with no further access control."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"daggerhart","product":"Query Wrangler","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.5.57","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:24:16.726566Z","id":"CVE-2026-14498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/query-wrangler/trunk/admin/ajax.php#L11","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/query-wrangler/trunk/admin/templates/preview-json.php#L8","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/query-wrangler/trunk/includes/fields/callback_field.php#L47","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/query-wrangler/trunk/query-wrangler.php#L147","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3640744%40query-wrangler&new=3640744%40query-wrangler","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9faa56-c550-465f-b0b0-8bf58f5e8d7a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-14524","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:46.493","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker must first call the proSol_fileUploadModalProcess handler to poison their own session with a path-traversal key, then call proSol_fileDeleteProcess with that key as the filename parameter; both steps require only the publicly exposed frontend nonce."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"prosolution","product":"ProSolution WP Client","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:41:08.869462Z","id":"CVE-2026-14524","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.3/includes/class-prosolwpclient.php#L260","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.3/public/class-prosolwpclient-public.php#L1135","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.3/public/class-prosolwpclient-public.php#L1256","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3634993%40prosolution-wp-client&new=3634993%40prosolution-wp-client","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9698f0-b228-4f4e-838b-c0c0a193d675?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15002","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:46.620","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerce_css_editor_content' POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress 'init' hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the 'woocommerce_bluemedia_settings' option via update_option(), then later echoed directly inside a <style> block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page)."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bluemediapl","product":"Autopay","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:16:24.153222Z","id":"CVE-2026-15002","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/platnosci-online-blue-media/tags/5.0.0/src/Domain/Service/Custom_Styles/Css_Editor.php#L96","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/platnosci-online-blue-media/tags/5.0.0/src/Domain/Service/Custom_Styles/Css_Editor.php#L98","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/platnosci-online-blue-media/tags/5.0.0/src/Domain/Service/Custom_Styles/Css_Frontend.php#L17","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/platnosci-online-blue-media/tags/5.0.0/src/Domain/Service/Settings/Settings_Manager.php#L94","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3636306%40platnosci-online-blue-media&new=3636306%40platnosci-online-blue-media","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f49ccf0f-99ec-410f-8bf0-2f15d8fd578f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15009","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:46.753","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to control a domain whose origin string is a leading prefix of the target site's backend URL (e.g. https://example.co against https://example.com), and the victim must be an authenticated WordPress administrator who visits the attacker-controlled page while the File Manager admin screen is open."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"saadiqbal","product":"Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:15:19.467721Z","id":"CVE-2026-15009","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.11/application/library/js/elFinder.js#L4596","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.11/application/library/js/elFinder.js#L4839","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.11/application/library/js/elFinder.js#L4856","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.12/application/library/js/elFinder.js#L4596","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.12/application/library/js/elFinder.js#L4839","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/file-manager-advanced/tags/5.4.12/application/library/js/elFinder.js#L4856","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3645011%40file-manager-advanced&new=3645011%40file-manager-advanced","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d164f5e-c313-4e45-a17b-61460b10204e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15066","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:46.880","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"timwhitlock","product":"Loco Translate","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:32.694703Z","id":"CVE-2026-15066","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.4/pub/js/min/admin.js#L1404","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.4/pub/js/min/admin.js#L3533","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.4/src/ajax/SaveController.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.5/pub/js/min/admin.js#L1404","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.5/pub/js/min/admin.js#L3533","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.5/src/ajax/SaveController.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3631056%40loco-translate&new=3631056%40loco-translate","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9571a2f3-d148-4e9b-8837-b8d212418613?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15441","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.010","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wcproducttable","product":"Product Table & List Builder For WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:18:23.096839Z","id":"CVE-2026-15441","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/5.1.0/main.php#L2677","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/5.1.0/main.php#L2686","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/5.1.0/style-functions.php#L995","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/5.4.0/main.php#L2677","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/5.4.0/main.php#L2686","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/5.4.0/style-functions.php#L995","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3638932%40wc-product-table-lite&new=3638932%40wc-product-table-lite","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0a8be1-8853-4863-90e5-af3831f800e9?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15602","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.140","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order vulnerability; the payload is stored via the submission_report2 AJAX handler (which lacks a nonce check and relies solely on a capability that can be configured down to subscriber-level) and triggered when a CSV export is generated."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"webaways","product":"NEX-Forms – Ultimate Forms Plugin for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"9.2.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:42:53.521152Z","id":"CVE-2026-15602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/includes/classes/class.dashboard.php#L5481","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/main.php#L3756","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.3/main.php#L3764","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3644732%40nex-forms-express-wp-form-builder&new=3644732%40nex-forms-express-wp-form-builder","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd094b8-440a-47ae-8edc-c23f1909d607?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15726","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.270","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cryout-creations","product":"Serious Slider","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T14:14:01.832203Z","id":"CVE-2026-15726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/cryout-serious-slider/tags/1.4.0/inc/shortcodes.php#L102","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cryout-serious-slider/tags/1.4.0/inc/shortcodes.php#L111","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cryout-serious-slider/tags/1.4.0/inc/shortcodes.php#L244","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/cryout-serious-slider/tags/1.4.0/inc/shortcodes.php#L55","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3640247%40cryout-serious-slider&new=3640247%40cryout-serious-slider","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f45054-e6a4-403b-94eb-2dd2a4840c22?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15963","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.407","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"expresstech","product":"Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"11.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:14:29.940360Z","id":"CVE-2026-15963","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.1/php/classes/class-qsm-fields.php#L77","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.1/php/classes/class-qsm-install.php#L271","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.1/renderer/frontend/class-qsm-render-pagination.php#L390","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/11.2.1/renderer/frontend/class-qsm-render-pagination.php#L392","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3612474%40quiz-master-next&new=3612474%40quiz-master-next","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1de31ae-4095-4863-9971-9de45c36f5a0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16079","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.537","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"pdamsten","product":"Fullscreen Galleria","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.6.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:45.974973Z","id":"CVE-2026-16079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/fullscreen-galleria/tags/1.6.12/galleria-fs.php#L1074","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/fullscreen-galleria/tags/1.6.12/galleria-fs.php#L1078","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/fullscreen-galleria/tags/1.6.12/galleria-fs.php#L146","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/fullscreen-galleria/tags/1.6.12/galleria-fs.php#L68","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/fullscreen-galleria/tags/1.6.12/galleria-fs.php#L74","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3635063%40fullscreen-galleria&new=3635063%40fullscreen-galleria","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3635066%40fullscreen-galleria&new=3635066%40fullscreen-galleria","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48d6cd72-6a38-403b-9a8f-960e99d8801f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16098","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.667","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is saved, and a post-save extension check that fails to delete the already-written file. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce required to reach the upload handler is publicly exposed via wp_localize_script on any front-end page rendering the job portal shortcode, allowing unauthenticated visitors to obtain a valid nonce and bypass that gating check entirely."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"prosolution","product":"ProSolution WP Client","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:25:19.440021Z","id":"CVE-2026-16098","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.6/includes/UploadHandler.php#L1090","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.6/includes/UploadHandler.php#L1327","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.6/includes/class-prosolwpclient.php#L254","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/prosolution-wp-client/tags/2.0.6/public/class-prosolwpclient-public.php#L1033","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3644463%40prosolution-wp-client&new=3644463%40prosolution-wp-client","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c4a7aef-09ec-4d17-87d6-f507d64e0afa?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16099","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.780","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). A viable POP chain exists within the plugin itself via Podlove\\ImageCache\\GenerationGuard, whose __destruct() method invokes wp_delete_file() with an attacker-controlled file path populated through unserialization."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"eteubert","product":"Podlove Podcast Publisher","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:42:20.977022Z","id":"CVE-2026-16099","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.3/lib/image_cache/generation_guard.php#L19","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.3/lib/image_cache/generation_guard.php#L57","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.3/lib/model/base.php#L552","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.3/lib/modules/shownotes/rest_api.php#L538","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.3/lib/modules/shownotes/rest_api.php#L585","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.5.3/lib/modules/shownotes/rest_api.php#L630","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3648110%40podlove-podcasting-plugin-for-wordpress&new=3648110%40podlove-podcasting-plugin-for-wordpress","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa6fd71-337f-4998-a15d-650aa4f6142c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16779","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:47.910","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite front-page configuration options (show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although a nonce check via check_ajax_referer() is present, the nonce is unconditionally emitted into window.kubioUtilsData for every user who can load the block editor, making it harvestable by any Contributor and therefore an ineffective authorization barrier."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"extendthemes","product":"Kubio AI Page Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T14:14:04.666812Z","id":"CVE-2026-16779","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/kubio/tags/2.8.5/lib/editor-assets.php#L411","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kubio/tags/2.8.5/lib/kubio-block-library.php#L197","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kubio/tags/2.8.5/lib/src/Core/KubioFrontPageRevertNotice.php#L151","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kubio/tags/2.8.5/lib/src/Core/KubioFrontPageRevertNotice.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3633801%40kubio&new=3633801%40kubio","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/febca991-90a0-46b8-9609-2c8a71b5eb5f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17123","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:48.033","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render (including a Contributor previewing their own draft), and the wpr_form_builder_webhook AJAX handler — registered for both authenticated and unauthenticated callers — reads that option and dispatches the outbound request via the non-safe wp_remote_post(), with no host allowlist, no scheme restriction, and no private/loopback IP filter (the plugin's existing wpr_is_blocked_remote_host / wpr_is_private_or_local_ip helpers are not called on this path). This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wproyal","product":"Royal Addons for Elementor – Addons and Templates Kit for Elementor","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.7.1064","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:16:00.465657Z","id":"CVE-2026-17123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/forms/wpr-send-webhook.php#L20","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/forms/wpr-send-webhook.php#L56","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/modules/form-builder/widgets/wpr-form-builder.php#L3788","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/forms/wpr-send-webhook.php#L20","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/forms/wpr-send-webhook.php#L56","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/modules/form-builder/widgets/wpr-form-builder.php#L3788","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8810200b-e026-4258-86aa-5c1a200fcf9b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18385","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:48.170","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The partial mitigation introduced via strip_shortcodes() on [profile-first-name] and [profile-last-name] can be bypassed through the [profile-display-name format=\"first_last_names\"] render path, the [profile-bio] render path (which re-fetches the raw description meta), and the double-bracket escape sequence [[tag]], all of which allow attacker-controlled shortcode text to reach the outer do_shortcode() call."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"properfraction","product":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.16.19","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:55.287299Z","id":"CVE-2026-18385","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.15/src/Classes/RegistrationAuth.php#L170","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.15/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L286","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.15/src/ShortcodeParser/MemberDirectoryTag.php#L98","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.15/src/Themes/DragDrop/MemberDirectoryListing.php#L90","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.19/src/Classes/RegistrationAuth.php#L170","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.19/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L286","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.19/src/ShortcodeParser/MemberDirectoryTag.php#L98","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.16.19/src/Themes/DragDrop/MemberDirectoryListing.php#L90","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3635466%40wp-user-avatar&new=3635466%40wp-user-avatar","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/345f3354-d2cb-4b92-a25d-9551a5992919?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18432","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T05:16:48.307","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"shabti","product":"Frontend Admin by DynamiApps","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.29.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:27:30.594573Z","id":"CVE-2026-18432","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/actions/user.php#L565","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/actions/user.php#L680","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/classes/display.php#L1654","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/classes/display.php#L1953","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.3/main/frontend/forms/classes/display.php#L37","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/actions/user.php#L565","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/actions/user.php#L680","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/classes/display.php#L1654","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/classes/display.php#L1953","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/tags/3.29.9/main/frontend/forms/classes/display.php#L37","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3633030%40acf-frontend-form-element&new=3633030%40acf-frontend-form-element","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01404fad-7b5a-485a-b557-c608fe25e6c9?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19932","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T05:16:48.443","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that \"it’s being processed\"."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"DefaultFuction","product":"Notice-System-Managent","cpes":["cpe:2.3:a:defaultfuction:notice-system-managent:*:*:*:*:*:*:*:*"],"modules":["NoticeController"],"versions":[{"version":"2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T14:02:29.744668Z","id":"CVE-2026-19932","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/DefaultFuction/Notice-System-Managent/","source":"cna@vuldb.com"},{"url":"https://github.com/DefaultFuction/Notice-System-Managent/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19932","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/872648","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390703","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390703/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19933","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T05:16:48.623","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project confirms, that \"it’s being processed\"."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"DefaultFuction","product":"Customer-Relationship-Management-In-C-Project","cpes":["cpe:2.3:a:defaultfuction:customer-relationship-management-in-c-project:*:*:*:*:*:*:*:*"],"modules":["Customer Search Module"],"versions":[{"version":"2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:40:28.161899Z","id":"CVE-2026-19933","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/","source":"cna@vuldb.com"},{"url":"https://github.com/DefaultFuction/Customer-Relationship-Management-In-C-Project/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19933","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/872649","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390704","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390704/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-10035","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:49.210","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpweaver","product":"Turnkey bbPress by WeaverTheme","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:38:37.991402Z","id":"CVE-2026-10035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-lib.php#L112","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-lib.php#L132","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/weaver-for-bbpress/tags/1.7.1/includes/wvrbbp-admin-top.php#L142","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3633471%40weaver-for-bbpress&new=3633471%40weaver-for-bbpress","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7411ab-174e-4bc2-9f96-dbce925a21eb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-13712","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:50.227","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Divi","defaultStatus":"unaffected","versions":[{"version":"5.0","lessThan":"5.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:14:35.838611Z","id":"CVE-2026-13712","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d3a37071-5fb1-4aa2-8f89-eb13c46f6126/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15056","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:50.340","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kodezen","product":"StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T14:14:11.589188Z","id":"CVE-2026-15056","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/api/vendors.php#L281","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/api/vendors.php#L37","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/role.php#L37","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/addons/multi-vendor/shortcode.php#L112","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/includes/classes/download-handler.php#L192","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/includes/classes/download-handler.php#L513","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/1.10.0/includes/classes/download-handler.php#L557","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/api/vendors.php#L281","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/api/vendors.php#L37","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/role.php#L37","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/addons/multi-vendor/shortcode.php#L112","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/includes/classes/download-handler.php#L192","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/includes/classes/download-handler.php#L513","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/storeengine/tags/2.0.0/includes/classes/download-handler.php#L557","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3628877%40storeengine&new=3628877%40storeengine","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a866dfd-2374-4a66-9dee-b8bda47d1cc7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15345","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:50.493","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"shortpixel","product":"ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.11.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:05:55.945184Z","id":"CVE-2026-15345","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.11.5/includes/actions/notice.actions.class.php#L16","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.11.5/includes/actions/notice.actions.class.php#L566","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.11.5/includes/actions/notice.actions.class.php#L614","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.11.5/includes/actions/notice.actions.class.php#L87","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.11.5/includes/controllers/notice.class.php#L747","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3625451%40shortpixel-adaptive-images&new=3625451%40shortpixel-adaptive-images","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3efae8f-ca89-4d8c-a177-6793994b3ea0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15351","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:50.620","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field callback strips HTML but leaves SQL metacharacters intact, and wp_magic_quotes slash protection does not apply because WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before the sanitize callback executes."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wcvendors","product":"WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.7.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:03.575197Z","id":"CVE-2026-15351","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wc-vendors/tags/2.7.0/classes/includes/api/admin/class-wcv-admin-api.php#L247","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-vendors/tags/2.7.0/classes/includes/api/admin/class-wcv-admin-api.php#L329","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-vendors/tags/2.7.0/classes/includes/api/admin/class-wcv-admin-api.php#L367","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wc-vendors/tags/2.7.0/classes/includes/api/admin/class-wcv-admin-api.php#L56","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3633716%40wc-vendors&new=3633716%40wc-vendors","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df790bbc-7427-4f7e-9aa2-e137c9fceffd?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15384","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:50.740","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Manual Image Crop","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:17:48.198274Z","id":"CVE-2026-15384","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://wpscan.com/vulnerability/706d0b6a-d136-4317-a767-33bcab3b041c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15604","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:50.840","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This is due to insufficient input sanitization in the toocheke_series_bg_color_save() function (which stores the raw $_POST value in post meta) and insufficient output escaping in the series admin column rendering (where the stored value is concatenated into a style attribute without esc_attr()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user, such as an administrator, accesses the series list table in the admin dashboard."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"toocheke","product":"Toocheke Companion","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:37:53.902649Z","id":"CVE-2026-15604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/toocheke-companion/tags/2.11/inc/class-toocheke-companion-admin-columns.php#L296","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/toocheke-companion/tags/2.3/inc/class-toocheke-companion-admin-columns.php#L296","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/toocheke-companion/tags/2.3/inc/class-toocheke-companion-metaboxes.php#L959","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/toocheke-companion/tags/2.3/inc/class-toocheke-companion-metaboxes.php#L960","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf78bc1-55d7-4230-913f-d7c521225367?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15790","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:50.967","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced by the shortcode's image field: EMD_MB_Helper::image_info() returns the attachment's raw post_title, and EMD_MB_Helper::shortcode() interpolates it into title=\"%s\" HTML attributes via sprintf() without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above (upload_files capability required to create the attachment, edit_posts/publish_posts to embed the shortcode), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"emarket-design","product":"Video Gallery – YouTube Gallery, Playlist & Video Grid","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:37:09.372445Z","id":"CVE-2026-15790","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/youtube-showcase/tags/4.0.4/assets/ext/emd-meta-box/inc/helpers.php#L274","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/youtube-showcase/tags/4.0.4/assets/ext/emd-meta-box/inc/helpers.php#L72","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3be5e544-1ea5-46f6-a15b-99b0e3718c91?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16758","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:51.090","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"aliakro","product":"Snippet Shortcodes","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T14:14:09.360054Z","id":"CVE-2026-16758","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/shortcode-variables/tags/5.1.7/includes/functions.php#L81","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shortcode-variables/tags/5.1.7/includes/shortcode.user.php#L14","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/shortcode-variables/tags/5.1.7/includes/shortcode.user.php#L74","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3647346%40shortcode-variables&new=3647346%40shortcode-variables","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd14860-2cf5-45ec-a1d6-69e43ecdb3be?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16775","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:51.217","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"smub","product":"Smash Balloon Social Post Feed – Simple Social Feeds for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:09:34.670925Z","id":"CVE-2026-16775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_FB_Settings.php#L59","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L1149","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/custom-facebook-feed/tags/4.9.0/inc/CFF_Shortcode.php#L312","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3640517/custom-facebook-feed/trunk/inc/CFF_Shortcode.php?old=3465306&old_path=custom-facebook-feed%2Ftrunk%2Finc%2FCFF_Shortcode.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae039144-2c02-4a00-9fff-f4e90a6a8236?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17533","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:51.340","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"All-in-One WP Migration and Backup","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.108","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:19:24.336168Z","id":"CVE-2026-17533","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://wpscan.com/vulnerability/13b57cdc-d954-4db6-94c2-53ad04ab0d34/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-17581","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:51.440","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kilbot","product":"WCPOS – Point of Sale (POS) plugin for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.9.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:13.337195Z","id":"CVE-2026-17581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Admin/Templates/Single_Template.php#L456","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Services/Receipt_Renderer_Factory.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates.php#L238","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates/Receipt.php#L251","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates/Renderers/Legacy_Php_Renderer.php#L42","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Admin/Templates/Single_Template.php#L456","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Services/Receipt_Renderer_Factory.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates.php#L238","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates/Receipt.php#L251","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates/Renderers/Legacy_Php_Renderer.php#L42","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3634267%40woocommerce-pos&new=3634267%40woocommerce-pos","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3efda0-8609-4a75-a00b-735b49ef260b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17582","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:51.563","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"quantumcloud","product":"Slider Hero with Video Background, Animation","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"9.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:21:18.571088Z","id":"CVE-2026-17582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L1206","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.6/qcld-slider-main.php#L392","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L1206","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/slider-hero/tags/9.1.7/qcld-slider-main.php#L392","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3635315%40slider-hero&new=3635315%40slider-hero","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b36621-3322-4631-b693-629c5084708b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18316","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:51.683","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"solacewp","product":"Solace Extra","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:37:52.644771Z","id":"CVE-2026-18316","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/solace-extra/tags/1.6.0/admin/class-solace-extra-admin.php#L289","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/solace-extra/tags/1.6.0/admin/import.php#L2382","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/solace-extra/tags/1.6.0/includes/class-solace-extra.php#L336","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3627961%40solace-extra&new=3627961%40solace-extra","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e427c4e-3e27-49e3-ba64-6241b430d5d8?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18402","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:51.807","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute in all versions up to, and including, 1.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored inside the block-delimiter HTML comment's JSON, which wp_kses_post does not neutralize on save, and is only interpolated into the rendered style attribute at display time without esc_attr() escaping, allowing a double-quote to break out of the attribute and introduce arbitrary HTML event handlers."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"brainstormforce","product":"SureDash – Community, Courses & Member Dashboard","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.10.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T14:14:07.336699Z","id":"CVE-2026-18402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.3/core/blocks/interactivity/build/Notification/view.php#L26","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.3/core/shortcodes/notification.php#L182","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/suredash/tags/1.10.3/core/shortcodes/notification.php#L189","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3632516%40suredash&new=3632516%40suredash","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d99bc37-4697-400a-bbd4-858543f17d1f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18653","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:51.927","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Directory Kit","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.5.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:20:46.279006Z","id":"CVE-2026-18653","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e064c261-bc7b-4605-8da7-c7036fc396fc/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19613","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.023","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ECS  WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"ECS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.3.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:22:46.683770Z","id":"CVE-2026-19613","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0d4ccc34-632a-4058-9220-b3cce7a942dd/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19711","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.120","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Premium Packages  WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Premium Packages","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.0.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:24:33.595664Z","id":"CVE-2026-19711","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ba209669-49bb-40f0-976d-7b77fa0a3c85/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19712","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.207","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Masteriyo LMS  WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators.\nThis affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Masteriyo LMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:01:22.190810Z","id":"CVE-2026-19712","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/08c31101-ee38-46e9-b451-abb1ed70079c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19714","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.300","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Simple JWT Login  WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login  WordPress plugin before 3.6.8's Google sign-in enabled is affected."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Simple JWT Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.6.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:03:43.331739Z","id":"CVE-2026-19714","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19717","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.390","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"CatFolders Document Gallery & PDF Library","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:04:57.440318Z","id":"CVE-2026-19717","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/79a4bae6-96e2-44b4-a56b-42198f8b3d32/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19725","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.487","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root.\n\nThe file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPvivid — Backup, Migration & Staging","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.9.131","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:07:07.653740Z","id":"CVE-2026-19725","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://wpscan.com/vulnerability/999889f4-f8be-4b44-b665-1a94df8d050d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19726","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.580","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Visualizer  WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer  WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Visualizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.0.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:09:41.652023Z","id":"CVE-2026-19726","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/61a1577e-077f-4a00-96b4-860eda48e03b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19728","sourceIdentifier":"contact@wpscan.com","published":"2026-08-16T06:16:52.673","lastModified":"2026-08-26T16:30:52.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it.\n\nThe Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Extra Product Options Builder for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.176","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T20:11:06.638909Z","id":"CVE-2026-19728","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/fd10aaab-d358-4d2f-aafa-dbfba09b7fff/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19934","sourceIdentifier":"cna@vuldb.com","published":"2026-08-16T06:16:52.773","lastModified":"2026-08-20T12:48:31.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /vieworder.php. The manipulation of the argument delid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Hospital Management System","cpes":["cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T13:24:25.088141Z","id":"CVE-2026-19934","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit_vuln/issues/19","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-19934","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/872695","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390708","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/390708/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-2283","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:53.003","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blog_id' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on multisite installations."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"faiyazalam","product":"User Login History","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:11:43.871298Z","id":"CVE-2026-2283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/user-login-history/tags/2.1.7/inc/admin/class-network-admin-login-list-table.php#L116","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/user-login-history/tags/2.1.7/inc/admin/class-network-admin-login-list-table.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/user-login-history/trunk/inc/admin/class-network-admin-login-list-table.php#L116","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/user-login-history/trunk/inc/admin/class-network-admin-login-list-table.php#L70","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3484407%40user-login-history&new=3484407%40user-login-history","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4552786b-3362-45bf-9012-cd52f69f0462?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-9767","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T06:16:55.133","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"weblizar","product":"The School Management – Education & Learning ERP","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:25:19.605174Z","id":"CVE-2026-9767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.3/admin/inc/school/staff/class/WLSM_Staff_Class.php#L160","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.3/admin/inc/school/staff/class/WLSM_Staff_Class.php#L49","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.3/admin/inc/school/staff/class/WLSM_Staff_Class.php#L51","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.3/admin/inc/school/staff/class/WLSM_Staff_Class.php#L558","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.3/admin/inc/school/staff/class/WLSM_Staff_Class.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.4/admin/inc/school/staff/class/WLSM_Staff_Class.php#L160","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.4/admin/inc/school/staff/class/WLSM_Staff_Class.php#L49","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.4/admin/inc/school/staff/class/WLSM_Staff_Class.php#L51","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.4/admin/inc/school/staff/class/WLSM_Staff_Class.php#L558","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/school-management-system/tags/5.4/admin/inc/school/staff/class/WLSM_Staff_Class.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3570107%40school-management-system&new=3570107%40school-management-system","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f0ff27-49d7-4aa0-aa00-2853eadecddb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-10734","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.043","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The /cf7_records viewer is accessible to any authenticated user including those with Subscriber-level access, meaning the injected payload executes for any logged-in user who visits the records page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"infility","product":"Infility Global","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.15.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:17:21.790736Z","id":"CVE-2026-10734","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/InfilityGlobalErrorRecord.php#L25","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/InfilityGlobalErrorRecord.php#L320","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/InfilityGlobalErrorRecord.php#L410","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/infility-global/trunk/include/InfilityGlobalErrorRecord.php#L414","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0de639a9-37a6-4a72-8afb-ff43de81a83c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-12998","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.173","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the 'draft' parameter and read other users' saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the 'Save and Continue' feature enabled."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpmudev","product":"Forminator Forms – Contact Form, Payment Form & Custom Form Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.55.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:39:16.649297Z","id":"CVE-2026-12998","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.52.2/library/model/class-form-entry-model.php#L160","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.52.2/library/model/class-form-entry-model.php#L212","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.52.2/library/render/class-render-form.php#L2000","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.52.2/library/render/class-render-form.php#L2011","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.0/library/model/class-form-entry-model.php#L160","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.0/library/model/class-form-entry-model.php#L212","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.0/library/render/class-render-form.php#L2000","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.0/library/render/class-render-form.php#L2011","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3593819%40forminator&new=3593819%40forminator","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36aa7193-0e31-4084-97d0-8c22ebff3f05?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-13424","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.300","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection point is the bookly_speed_up_update_addons AJAX action, which is registered as wp_ajax_nopriv_* and therefore reachable without authentication; the payload is stored verbatim in the bookly_log.details column when a request is submitted without a valid signature, and executes when an administrator later views the Diagnostics → Logs page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ladela","product":"Online Scheduling and Appointment Booking System – Bookly","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"27.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:16:26.379081Z","id":"CVE-2026-13424","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/backend/modules/diagnostics/Ajax.php#L344","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/backend/modules/diagnostics/resources/js/diagnostics.js#L542","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/lib/PluginsUpdater.php#L13","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.5/lib/PluginsUpdater.php#L97","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/backend/modules/diagnostics/Ajax.php#L344","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/backend/modules/diagnostics/resources/js/diagnostics.js#L542","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/lib/PluginsUpdater.php#L13","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/lib/PluginsUpdater.php#L97","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3637918%40bookly-responsive-appointment-booking-tool&new=3637918%40bookly-responsive-appointment-booking-tool","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb53e44-7f9d-490f-b938-f428c20219d7?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17087","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.423","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wptravelengine","product":"WP Travel Engine – Tour Booking Plugin – Tour Operator Software","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.8.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T16:57:06.327084Z","id":"CVE-2026-17087","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/classes/Abstracts/AjaxController.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/classes/Builders/FormFields/BillingFormFields.php#L87","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/classes/Core/Controllers/Ajax/AddToCart.php#L232","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/classes/Core/Controllers/Ajax/AddToCart.php#L31","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.7.12/includes/classes/Legacy/Cart.php#L373","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.8.3/includes/classes/Abstracts/AjaxController.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.8.3/includes/classes/Builders/FormFields/BillingFormFields.php#L87","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.8.3/includes/classes/Core/Controllers/Ajax/AddToCart.php#L232","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.8.3/includes/classes/Core/Controllers/Ajax/AddToCart.php#L31","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.8.3/includes/classes/Legacy/Cart.php#L373","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3632552%40wp-travel-engine&new=3632552%40wp-travel-engine","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc4a6f9-b663-4573-9a6d-0c96ee25308d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17604","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.547","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themeum","product":"Kirki – Freeform Page Builder, Website Builder & Customizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T19:24:55.562780Z","id":"CVE-2026-17604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax.php#L349","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L182","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L186","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L26","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.12/includes/Ajax/ExportImport.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax.php#L349","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L182","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L186","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L26","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/ExportImport.php#L52","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3629933%40kirki&new=3629933%40kirki","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ecb2c6-c2d0-44b0-b9c2-4fcbc0f97632?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-17608","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.663","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"aresit","product":"WP Compress – Instant Performance & Speed Optimization","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.10.09","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T19:19:21.972087Z","id":"CVE-2026-17608","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/menu.class.php#L239","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/menu.class.php#L335","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/templates/admin/advanced_settings_v4.php#L2378","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/templates/admin/debug_tool.php#L550","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/templates/admin/debug_tool.php#L551","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3641964%40wp-compress-image-optimizer&new=3641964%40wp-compress-image-optimizer","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67013cc9-c20f-4137-9a4d-e7d700899131?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18347","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.787","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themeum","product":"Kirki – Freeform Page Builder, Website Builder & Customizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T15:39:51.047450Z","id":"CVE-2026-18347","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/API/Frontend/Controllers/CollectionController.php#L97","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/API/Frontend/Controllers/FrontendRESTController.php#L42","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/API/Frontend/Controllers/FrontendRESTController.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/Ajax/Users.php#L227","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.9/includes/HelperFunctions.php#L1098","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/API/Frontend/Controllers/CollectionController.php#L97","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/API/Frontend/Controllers/FrontendRESTController.php#L42","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/API/Frontend/Controllers/FrontendRESTController.php#L82","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/Ajax/Users.php#L227","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/kirki/tags/6.1.1/includes/HelperFunctions.php#L1098","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3629933%40kirki&new=3629933%40kirki","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1e0bcd-f881-4b01-b802-7cb18a22a07f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-2357","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:30.910","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldthemes","product":"Bold Page Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.6.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T14:14:13.670051Z","id":"CVE-2026-2357","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3479329%40bold-page-builder&new=3479329%40bold-page-builder","source":"security@wordfence.com"},{"url":"https://wordpress.org/plugins/bold-page-builder/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63cab921-60fa-42c5-ad0d-69de8cc91332?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-2497","sourceIdentifier":"security@wordfence.com","published":"2026-08-16T07:16:31.030","lastModified":"2026-08-20T12:48:10.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `gllr_save_postdata()` function stores unsanitized array keys from `$_POST` directly into post meta, which are later used in SQL queries without prepared statements. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"bestwebsoft","product":"Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.7.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T17:01:14.622563Z","id":"CVE-2026-2497","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/gallery-plugin/tags/4.7.6/gallery-plugin.php#L1052","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gallery-plugin/tags/4.7.6/includes/class-gllr-media-table.php#L58","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gallery-plugin/trunk/gallery-plugin.php#L1052","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/gallery-plugin/trunk/includes/class-gllr-media-table.php#L58","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3609291%40gallery-plugin&new=3609291%40gallery-plugin","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/884b97b7-d023-4752-81b1-086ab022f85e?source=cve","source":"security@wordfence.com"}]}}]}