Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-89900

media: cec: core: Fix kmemleak due to missed rc_free_device() call

In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rc_free_device() call The commit dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks") removed the implicit call to rc_free_device() from rc_unregister_device(). However, the commit missed to remove the NULL assignment of adap->rc that is now causing rc_free_device() to never be called on an allocated rc device. kmemleak reports following after e.g. dw-hdmi unbind: unreferenced object 0xffff00010ac10000 (size 4096): comm "kworker/u16:1", pid 39, jiffies 4294897739 hex dump (first 32 bytes): 20 23 4b 0a 01 00 ff ff 08 00 c1 0a 01 00 ff ff #K............. 08 00 c1 0a 01 00 ff ff 00 00 00 00 00 00 00 00 ................ backtrace (crc e11baccc): kmemleak_alloc+0x38/0x44 __kmalloc_cache_noprof+0x4a8/0x5e0 rc_allocate_device+0x48/0x2a0 cec_allocate_adapter+0x3ac/0x800 dw_hdmi_cec_probe+0x264/0x634 platform_probe+0xc0/0x188 really_probe+0x4a4/0x8e0 __driver_probe_device+0x2f8/0x440 driver_probe_device+0x60/0x160 __device_attach_driver+0x1a0/0x2a0 bus_for_each_drv+0x100/0x1a0 __device_attach+0x174/0x350 device_initial_probe+0x90/0xb0 bus_probe_device+0x4c/0x120 device_add+0xdec/0x116c platform_device_add+0x354/0x598 Remove the assignment of adap->rc to NULL to let cec_delete_adapter() free the allocated rc device after last user of the cec device exits to fix the kmemleak.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-90119

ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup snd_ice1712_probe() performs multiple initialization steps after snd_card_new(), but directly returns on failures from later steps without releasing the ALSA card, causing resource leaks when probing fails. Use snd_devm_card_new() together with scope-based cleanup via __free(snd_card_unref), and clear the card pointer after successful registration to keep it alive.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-96543

gimp: gimp: out-of-bounds heap write when loading non-square PVR images

An out-of-bounds heap write flaw was found in GIMP's PVR image loader. When loading a crafted non-square PVR texture, pvr_decode_twiddle() can write attacker-controlled pixel data beyond the end of a correctly allocated heap buffer because the destination offset is not bounds-checked. A local attacker can exploit this by convincing a user to open a malicious PVR image, potentially causing arbitrary code execution in the file-pvr plug-in process.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed
Vendors
Gnome
Products
Gimp
CVE-2026-96544

gimp: gimp: integer overflow in the PVR image loader leads to an out-of-bounds heap read

An integer overflow flaw was found in GIMP's PVR image loader. When a user opens a crafted PVR image, unchecked multiplication of attacker-controlled dimensions in pvr_decode_rect() can result in an undersized heap allocation followed by an out-of-bounds read. This may disclose adjacent heap contents through the decoded image or crash the file-pvr plug-in.

CVSS 3.1 · 6.1 Medium EPSS n/a KEV · Not listed
Vendors
Gnome
Products
Gimp
CVE-2026-75131

NetworkManager-l2tp Privilege Escalation via pppd Username Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Nm-l2tp
Products
Networkmanager-l2tp
CVE-2026-94487

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress
Products
Capabilities Wordpress
CVE-2026-93623

WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jordy Meow Wordpress
Products
Ai-engine Wordpress
CVE-2026-90905

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Joomshaper.com
Products
Easy Store Extension For Joomla
CVE-2026-55632

GoCD is vulnerable to authorization bypass via pipeline structure API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names, which can facilitate attacks against those users. The response does not reveal which roles are assigned to each user, and the endpoint cannot modify data. This issue is fixed in version 26.1.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gocd
Products
Gocd
CVE-2026-82368

Insecure Access Controls Permit Local Non-Administrative Users to Command Fabric OS Switches

Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Brocade
Products
Sannav
CVE-2026-94498

WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Appmysite Wordpress
Products
Appmysite Wordpress