A vulnerability in the Linux kernel's ksmbd component involves improper handling of connection references for session channels. The flaw allows a connection to be freed while still being accessed by another session reference holder, potentially leading to use-after-free conditions during SMB3.1.1 binding or procfs reads. The issue is addressed by holding a connection reference for each session channel until the session is fully destroyed.
A use-after-free vulnerability in the Linux kernel ALSA line6 driver was fixed by clearing a stale pointer on capture buffer release. The flaw involved a slab-use-after-free read in submit_audio_out_urb() when playback started after capture streams were closed, due to a stale pointer not being cleared. This could lead to kernel memory corruption or crashes.
A vulnerability in the Linux kernel's ksmbd component allowed clients to create an unbounded number of valid SMB sessions on a single connection by repeatedly completing authentication, due to improper session limit enforcement. The issue has been addressed by reserving connection slots before session allocation and enforcing a configurable maximum sessions per connection, defaulting to 64. The fix also exposes this limit via procfs and maintains compatibility with existing request formats.
A Cross-Site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.8 due to improper neutralization of script-related HTML tags. This flaw allows code injection via web pages generated by the affected plugin. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability in OpenBMB Internet of Agents affects the launch_goal function in the Collaboration Layer component. Manipulating the max_turns argument can cause an infinite loop. The issue can be triggered remotely. The product uses a rolling release model, so specific affected versions are not identified. Public exploit code exists, but no official response or patch has been provided yet.
A vulnerability in the Linux kernel SMB client related to the fiemap ioctl handling allows a wild read from an empty truncated response from a malicious SMB2 server. The flaw occurs when the server returns a STATUS_BUFFER_OVERFLOW with an empty output, causing the client to read memory before a NULL pointer, potentially leading to a kernel oops (crash). The issue has been fixed by rejecting empty truncated range blobs and adding checks to prevent infinite loops or underflows.
CVE-2026-99276 is a vulnerability in the Linux kernel's ksmbd component related to connection scavenging and session lock handling. The flaw involves a potential deadlock scenario where the expiration worker holds a read lock while waiting for session locks that are held by a writer queued on the same lock, causing a circular wait. The fix defers connection scavenging when session locks are busy, allowing the worker to retry later instead of blocking.
An authorization bypass vulnerability exists in CrocoBlock JetFormBuilder – Hierarchical Select plugin versions up to 1.0.10. The flaw arises from incorrectly configured access control security levels, allowing an attacker to bypass authorization checks by manipulating a user-controlled key. This vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability in SililaWijesinghe Food Ordering System allows remote attackers to obtain information via directory listing in the /Food-Ordering-System/admin/ path. The product lacks versioning, so affected versions cannot be precisely identified. The vendor did not respond to early disclosure attempts. Public exploit code is available. The CVSS score is 5.3, indicating medium severity.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reserve space for the UTF-16 terminator in stream info
smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the
converted characters, but get_file_stream_info() budgets only
sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry
and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing
"::$DATA" entry. When an entry exactly fills the 448-byte small response
buffer, the terminator is written two bytes past the allocation.
Reserve one extra UTF-16 unit in both budget checks. The terminator is
not part of the wire format, so the reported lengths are unchanged.
A vulnerability in the Keycloak server's client management component allows an authenticated attacker with client management permissions to upload a malicious JavaScript policy due to improper clearing of an internal session attribute. This flaw enables execution of arbitrary code on the server during authorization requests, potentially compromising the entire system. Exploitation requires elevated privileges and authenticated access. Red Hat rates this vulnerability as Important rather than Critical due to these requirements. No effective mitigation or patch is currently available.
A Cross-Site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.8 due to improper neutralization of script-related HTML tags. This vulnerability allows an attacker to inject code that could be executed in the context of a user's browser. The vulnerability has a medium severity score of 5.3 and does not require user interaction or privileges to exploit.
CVE-2026-120841 is a high-severity vulnerability in the WpTravelly tour-booking-manager plugin by Magepeople inc. It involves improper control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion (LFI). This flaw affects versions up to and including 2.3.8 of WpTravelly. The vulnerability allows an attacker with low privileges to cause high impact on confidentiality, integrity, and availability without user interaction.
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.0.2.
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress versions up to and including 3.8.0 contains a vulnerability that allows unauthenticated attackers to delete arbitrary attachments. This occurs due to a missing capability or ownership check in the ajax_remove_uploaded() function, which is accessible via both authenticated and unauthenticated AJAX endpoints and protected only by a nonce exposed on the public checkout page. Exploitation can lead to loss of important media files and potential denial of service.