A CSV formula injection vulnerability exists in the iCagenda extension for Joomla versions 3.5.0 through 4.0.16. This flaw involves improper neutralization of formula elements in CSV files generated by the registrations export feature, which could allow malicious formulas to be injected into exported CSV data.
Axel Download Accelerator versions 2.17.14 and earlier contain a path traversal vulnerability due to improper handling of URL-encoded sequences in the output filename. This flaw allows an attacker to craft URLs with encoded '../' sequences that bypass URL parsing and cause downloaded files to be written outside the intended directory.
CVE-2026-116855 is a missing authorization vulnerability in the wphocus My auctions allegro plugin, affecting versions prior to 4.0.4. This flaw allows attackers with limited privileges to bypass access controls, potentially leading to unauthorized information disclosure or modification. The issue has been fixed in version 4.0.4.
CVE-2026-118477 is an OS Command Injection vulnerability in the ei_git_repo_url parameter of the Git remote configuration endpoint in EISGE Kalifast. An authenticated attacker, who can register freely, can exploit this flaw to execute arbitrary commands on the server with www-data privileges. The vulnerability is fixed in version 2026.02.1.
Four vulnerabilities in EPICS Base, a core component of the EPICS control system software used in particle accelerators and fusion labs, have been patched. These flaws, discovered by an autonomous system, can cause process crashes and potentially enable remote code execution. The most severe issue is an integer overflow leading to memory corruption. The vulnerabilities affect EPICS Base version 7.0.10 and earlier, with a fix available in version 7.0.11. Exploitation requires network access to specific EPICS services but no authentication or user interaction. No public exploitation has been reported.
CVE-2026-6064 is a link following vulnerability in the Data Shredder components of Norton Antivirus, Avast Antivirus, and AVG Internet Security on Windows. It affects versions prior to 26.5.10933 and allows a local, low-privileged attacker to escalate privileges to SYSTEM by enabling arbitrary file or folder deletion during a privileged shred operation.
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
A vulnerability in the Linux kernel's Hyper-V driver (hv) involves improper resetting of the VMBus connection state on error or exit paths. This flaw causes the connection state to be set to DISCONNECTED prematurely, preventing the proper unloading of the VMBus connection. As a result, the Hyper-V host may continue sending messages or interrupts to the guest, potentially leading to unexpected behavior. The issue was introduced by a commit that changed how connection state was checked before unloading. The vulnerability affects specific Linux kernel versions prior to fixes in versions 4.20, 5.5, and 5.7.
CVE-2026-99215 is a use-after-free vulnerability in the Linux kernel's power supply core subsystem. It occurs when a power supply device is unregistered while its callback function is still running, potentially leading to kernel crashes due to accessing freed driver data. This issue arises particularly when the hardware bus malfunctions shortly after registration, causing queued callbacks to execute during device removal. The vulnerability has been fixed by introducing a read-write semaphore to prevent unregistration while callbacks are active.
A vulnerability in the Linux kernel's drm/vc4 HDMI driver caused a kernel crash due to improper handling of Packet RAM power management. Audio infoframe writing could occur when Packet RAM was disabled, leading to a kernel warning and crash. The issue was fixed by moving Packet RAM enablement to runtime power management hooks.
A vulnerability in the Linux kernel's vsock subsystem involves improper handling of the TCP_CLOSING state during socket connection teardown. This flaw can lead to memory corruption and kernel crashes due to double insertion of sockets in the connected_table. The issue arises from a race condition when resetting a socket still present in connected_table, causing kernel oops and invalid opcode errors. The vulnerability has been fixed in specific Linux kernel commits.
A vulnerability in the Linux kernel's net/rds subsystem involves improper handling of RDMA connection IDs during route failure events. Specifically, the rdma_cm component could destroy an ID that the RDS subsystem still owns, leading to a use-after-free condition. This flaw was fixed by ensuring the connection ID remains owned by RDS until proper shutdown, preventing premature destruction.
A vulnerability in the Linux kernel netlink subsystem involves improper resetting of socket buffer (skb) headers before unicast and multicast filtering. This flaw allows unprivileged NETLINK_RDMA users to potentially disclose reserved headroom data in netlink messages due to filters reading uninitialized skb header data. The issue has been fixed by resetting both network and MAC headers before running the receiver's filter in unicast and broadcast delivery paths.
A vulnerability in the Linux kernel's accel/rocket driver was fixed by ensuring the rdev pointer is cleared on device initialization failure. Previously, if rocket_device_init() failed, rdev was left as an error pointer, causing subsequent code to dereference an invalid pointer. This could lead to kernel crashes or undefined behavior.
CVE-2026-99209 is a vulnerability in the Linux kernel's drm/xe component where eviction of a buffer object (BO) with no associated resource can cause a NULL pointer dereference. This occurs when an imported dma-buf BO's resource is freed during teardown but its attachment remains live, leading to a fault during eviction. The issue has been fixed by skipping eviction for BOs without resources, preventing the NULL dereference.
A vulnerability in the Linux kernel's drm/xe/oa component allows stale kernel memory to be exposed to userspace via mmap due to uninitialized OA buffers. This occurs because ttm_bo_type_kernel buffer objects are not zeroed on allocation, potentially leaking sensitive kernel memory contents. The flaw affects Linux kernel version 6.11 and has been fixed by zeroing the buffer at allocation.