Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-23 07:25Z
2026-08-15
2026-08-15 13:17Z
CRIT

CVE-2026-73193 — DBI: versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-73193

DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 CVSSv3.1 9.8 (CRITICAL)

CWECWE 787CWECWE 190VNDDbiTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 10:16Z
HIGH

CVE-2026-18438 — Templately: plugin for WordPress is vulnerable to Remote Code Execution in all versions up to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18438

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. Thi CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile

CWECWE 434VNDTemplatelyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 09:16Z
CRIT

CVE-2026-16142 — TrueBooker: The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16142

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile

CWECWE 639VNDTruebookerTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 07:16Z
CRIT

CVE-2026-15826 — User: The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15826

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error chec CVSSv3.1 9.8 (CRITICAL) · EPSS 54th percentile

CWECWE 704TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 07:16Z
HIGH

CVE-2026-14279 — Wholesale: The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14279

The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the CVSSv3.1 8.8 (HIGH) · EPSS 21th percentile

CWECWE 269VNDWholesaleTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74439 — Linux: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74439

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is still set. This creates a window where the hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behavior or spurious faults. The context-c CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74436 — Linux: In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74436

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() sets rx->backlog = NULL and frees the backlog rings, so a kernel preallocation worker can keep using a freed struct rxrpc_backlog while updating *_backlo CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74434 — Linux: This leads to memory corruption and to a use-after-free caused by the connection refcount

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74434

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and, if a response is needed, moves it onto the pending_oobq tree. However, only the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto pending_oobq always runs. As a result, reading a challenge with MSG_PEEK leaves the skb on recvmsg_oobq while also adding it to pendi CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74433 — Linux: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74433

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgk_issue_challenge() Fix rxgk_issue_challenge() to free the page containing the challenge content after invoking the tracepoint as the whdr passed to the tracepoint points into the page just freed. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74428 — Linux: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74428

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpc_recvmsg() Fix a double unlock in rxrpc_recvmsg() when dealing with OOB messages. CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74427 — Linux: In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls are disabled (i.e. listen 0). Also, if net->live is false because the afs netns is being deleted, make afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid requ CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74413 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74413

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers rtw89 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. The adjacent io_slot_reset() already does it correctly. Use ieee80211_stop_queues CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74412 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74412

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach to operate on an ieee80211_hw struct, reading and writing at wrong offsets. Use ieee80211_stop_queues/wake_queues instead, consistent with every other queue s CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74411 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds, leading to a system panic. RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends the low 8 bits of RBX into RAX. RBX (the counter i) has reached a huge value: 0x137466a1. watchdog: BU CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74410 — Linux: The result can exceed RTK_PCI_RX_BUF_SIZE (11478), causing an out-of-bounds read from the pre-allocated DMA

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74410

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both firmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478), causing an out-of-bounds read from the pre-allocated DMA buffer when skb_put_data copies new_len bytes. The USB transpo CVSSv3.1 8.1 (HIGH)

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74409 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74409

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac_id in link lookup The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver currently assigns mac_id values below 128, the descriptor value comes from firmware and is not validated before use as an array index. Add a defensive bounds check in rtw89_assoc_link_rcu_dereference CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74408 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74407 — Linux: The crash is a NULL pointer dereference in the MHI teardown path while freeing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74407

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. Simplified trace: dma_free_attrs mhi_deinit_dev_ctxt [mhi] ath11k_pci_power_down [ath11k_pci] ath11k_pci_shutdown [ath11k_pci] device_shutdown kernel_r CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74406 — Linux: In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running. Let's check if rcu_dereference_sk_user_data() is NULL after skb_gro_remcsum_init(). CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74401 — Linux: The side effects of not having it correct ordered regarding "before(mh->seq, seq)" are refcounting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74401

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in send_queue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh->seq is not ordered according the oldest seq number. This ordering is required by dlm_receive_ack as "before(mh->seq, seq)" will stop to check for older sequence numbers that are ordered in the tail of "node->send_queue". The side effect CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74398 — Linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74398

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwri CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74394 — Linux: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74394

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking allows a malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap around to a small value, bypassing the bounds check, and subsequently passing a ~4GB length to sg_init_one(). Use check_add_overflow() to detec CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
CRIT

CVE-2026-74384 — Linux: As a result, accesses such as: head->current_path[8] or head->current_path[252] goes out of bounds, leading

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74384

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvme_ns_head struct nvme_ns_head contains a flexible array member, current_path[], which is indexed using the NUMA node ID: head->current_path[numa_node_id()] The structure is currently allocated as: size = sizeof(struct nvme_ns_head) + (num_possible_nodes() * sizeof(struct nvme_ns *)); head = kzalloc(size, GFP_KERNEL); This allocation assumes that NUMA CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74383 — Linux: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74383

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools nvme_setup_descriptor_pools() indexes dev->descriptor_pools[] using the numa_node forwarded from hctx->numa_node by its single caller, nvme_init_hctx_common(). On a non-NUMA kernel hctx->numa_node is NUMA_NO_NODE (-1). Because the parameter was declared 'unsigned', the value becomes UINT_MAX and the index walks off the array (sized to nr_no CVSSv3.1 8.4 (HIGH)

TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-15
2026-08-15 06:22Z
HIGH

CVE-2026-74380 — Linux: In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu_map_sgtable()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommu_map_sgtable() return value check Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero. pin_job() also was incorrectly assigning to 'int', which could cause overflows into negative values. Update pin_job() to correctly check for errors from iommu_map_sgt CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score