In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and sctp_process_strreset_resp() complete a pending stream reconfiguration request by stopping the reconf timer on the transport it was sent on: t = asoc->strreset_chunk->transport; if (timer_delete(&t->reconf_timer)) sctp_transport_put(t); chunk->transport is assigned by __sctp_packet_append_chunk() when the chunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms the reconf timer at that same point. A request already published in asoc->strreset_chunk but not yet transmitted has neither, so completing it dereferences NULL. Two ways to get there. sctp_send_asconf_del_ip() sets asoc->src_out_of_asoc_ok without sending anything when the address being removed is the association's last one, and sctp_outq_flush_ctrl() then leaves every non-ASCONF control chunk queued; as only sctp_process_asconf_ack() clears that flag, it persists. An unprivileged process that removes such an address and then asks for a stream reset panics the kernel from softirq. A peer needs neither ASCONF nor local help: sctp_cmd_interpreter() uncorks the outqueue only once the whole packet has been processed, so a reply built while walking a RECONF chunk stays untransmitted for the rest of that walk, and one RECONF chunk carrying [Incoming SSN Reset Request, Outgoing SSN Reset Request, Response] -- or two RECONF chunks in one packet -- reaches the same dereference. KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef] RIP: 0010:timer_delete+0x67/0x110 Call Trace: <IRQ> sctp_process_strreset_addstrm_out (net/sctp/stream.c:832) sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212) sctp_do_sm (net/sctp/sm_sideeffect.c:1172) sctp_assoc_bh_rcv (net/sctp/associola.c:1044) sctp_rcv (net/sctp/input.c:243) ip_local_deliver (net/ipv4/ip_input.c:262) process_backlog (net/core/dev.c:6680) </IRQ> A response can only acknowledge a request that was actually sent, so do not match asoc->strreset_chunk while chunk->transport is NULL. Guarding the lookup covers all three completion sites.
A vulnerability in the Linux kernel's efivarfs filesystem allows unprivileged users to cause a flood of costly QueryVariableInfo() calls by repeatedly invoking statfs() on the efivarfs mount point. This can disproportionately impact x86 systems where the variable store is backed by System Management Mode (SMM), as each call requires synchronization of all CPUs. The issue has been addressed by rate limiting these calls to twice per second and returning cached results for additional calls within that interval.
A vulnerability in the Linux kernel's NFS server (nfsd) related to the setattr operation has been resolved. The issue involved missing a call to fh_want_write() after an early verification step in nfsd_proc_setattr(), which caused notify_change() to run without a mount write reference. This flaw could lead to improper handling of file attribute changes.
A vulnerability in the Linux kernel's NFSv4.1 implementation caused a layout segment leak in the pnfs_layout_process() function. This issue arises when the server returns a new layout stateid while a valid one is still held, leading to improper freeing of layout segments. The problem is due to a missing call to pnfs_free_lseg_list() in the error handling path, which was removed and not restored in subsequent commits. This leak affects specific Linux kernel versions used in various Ubuntu distributions.
In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the function returns without balancing the enable_irq() call. Disable the IRQ before leaving the failed wait path. Also preserve an interrupted wait's original error code instead of converting it to -ETIMEDOUT inside the helper.
CVE-2026-89672 is a critical vulnerability in the Linux kernel's NFS server (nfsd) related to the handling of NFSv2 SETACL requests. The flaw causes the server to unconditionally call set_posix_acl() with potentially NULL pointers, leading to unintended removal of access control lists (ACLs) when certain mask bits are omitted. This can result in silent stripping of directory default ACLs or both ACLs, impacting file system permissions. The issue has been fixed by gating set_posix_acl() calls on the mask bits and ensuring requests with no bits set leave ACLs unchanged.
A vulnerability in the Linux kernel's CIFS implementation was fixed by ensuring the function pagecache_isize_extended() is called in cifs_setsize() when extending a file. Previously, this call was skipped, which could result in stale data being written back to the server in the newly extended file range.
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of the view permissions on those groups, disclosing the organization's group structure, roles, and access hierarchy. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. WordPress's server-side HTML encoding of the 's' search parameter in the <title> element is bypassed because the browser DOM API decodes HTML entities when jQuery's .text() method reads document.title, returning literal special characters that are then embedded unescaped into the constructed HTML attribute value.
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.
CVE-2026-88924 is a local privilege escalation vulnerability in the GNOME gvfs admin backend. The gvfsd-admin daemon improperly changes ownership of private D-Bus sockets using a link-following chown() call on user-controlled paths. This allows a local attacker to exploit a TOCTOU race condition by replacing the socket pathname with a symlink to a root-owned file, causing the daemon to change ownership of critical system files to the attacker. Successful exploitation leads to full root privileges.
Mantax Otax is an Android malware targeting devices running Android 9 and earlier. It combines ransomware and spyware capabilities, encrypting files with AES and appending .enc extensions. The malware requests extensive permissions, including device administrator and accessibility access, to steal sensitive data such as screen recordings, browser history, PINs, contacts, call logs, SMS, and chats from WhatsApp and Telegram. It communicates with command and control servers via HTTPS and WebSockets, using dynamic domain resolution through GitHub. Version 2 introduces advanced features like UI hijacking, screen blocking, touch input interception, harassment capabilities, and remote text-to-speech. Data exfiltration is facilitated through Firebase and Catbox services, enabling a double-extortion scheme with an interactive ransom chat portal.
OWASP OASIS is a community-driven initiative under OWASP aimed at validating AI-generated security fixes for open source vulnerabilities before they are merged upstream. The project seeks volunteers to help review and validate these fixes to improve open source security. This is not a vulnerability or exploit but a call for participation in a security validation effort.
The npm package crypto-validates@0.0.2 contains malicious code that exfiltrates data by base64-encoding input to its validate function and sending it, along with random bytes generated by crypto.randomBytes, to a remote server. The package does not execute code on install or import, but performs data exfiltration on the first function call. It is published by the same author as other suspicious packages. Systems with this package installed should be considered fully compromised.
The npm package pumpswap-sdk-v1 version 0.0.1 contains malicious code that exfiltrates data by base64-encoding inputs and sending them to a remote server. It also sends cryptographic random bytes to the same server. This behavior occurs on the first call to the package functions, not on install or import. The package is considered fully compromising any system it is installed on, requiring immediate secret and key rotation and removal of the package. Complete system compromise is possible, and removing the package alone may not eliminate all malicious software.
tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim's browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim's authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where a failed Storage::delete() still nulled the model's image field, orphaning the file on disk. The condition is not directly attacker-controlled: it is triggered when any legitimate authenticated user submits an image upload while the storage backend transiently fails (for example an S3 network error, a local filesystem permission problem, or quota exhaustion). The result is unrecoverable loss of the prior image and a durable inconsistency between the database and disk that requires manual reconciliation. All models whose controllers route through ImageUploadRequest::handleImages (assets, asset models, users, companies, manufacturers, locations, categories, suppliers, departments, and other image-carrying models) are affected.
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying League\Csv\EscapeFormula, unlike the other CSV exports which honor config('app.escape_formulas'). An authenticated user with ordinary create/edit rights can place a spreadsheet formula in free-text fields that appear in the report (item name, asset tag, serial, item or location company name, location name) and arrange for the record to be FMCS-mismatched so it is included in the export. When a superuser downloads the report and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled and external-content warnings dismissed or disabled, cells beginning with =, +, -, @, tab, or CR are executed in the victim's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on Windows Excel, legacy DDE command execution. This issue is fixed in version 8.7.0.
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The $wpdb->prepare() call does not protect against this injection because the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() executes — prepare() only processes %s/%d placeholders and cannot sanitize content already embedded in the format string. REST API JSON bodies are parsed from php://input and bypass WordPress's wp_magic_quotes(), meaning double-quote characters in status array values reach the SQL sink unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required 'mint_read_contacts' capability is a plugin-specific capability not assigned to any default WordPress role; it must be explicitly granted by an administrator, making this effectively an Administrator+ vulnerability.
