CVE-2026-112859 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Little Birdies product, affecting versions from 0 up to and including 1.3.16. This vulnerability allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, indicating a highly severe issue exploitable remotely without privileges or user interaction.
A critical deserialization of untrusted data vulnerability (CVE-2026-112858) exists in axiomthemes Rhodos theme versions up to 1.3.3. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8, indicating high severity and ease of remote exploitation without privileges or user interaction.
CVE-2026-112848 is a critical deserialization of untrusted data vulnerability in AivahThemes Hostme v2. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. It affects Hostme v2 versions from 0 up to and including 7.0. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. No patch or remediation information is provided in the available data.
A Cross-site Scripting (XSS) vulnerability exists in AivahThemes Hostme v2, identified as CVE-2026-112849. This vulnerability involves improper neutralization of input during web page generation, allowing DOM-based XSS attacks. It affects Hostme v2 versions up to and including 7.0. The vulnerability has a high severity rating with a CVSS score of 7.1. No patch or remediation information is currently provided.
CVE-2026-112850 is a high-severity vulnerability in AncoraThemes Your Dress (versions up to 1.4.1) involving improper control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion. This flaw allows an attacker to include unauthorized files on the server, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-112854 is a critical deserialization of untrusted data vulnerability in axiomthemes Holistic Center up to version 1.2.6. It allows object injection, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation details are currently provided.
CVE-2026-112851 is a critical vulnerability in ThemeREX Group HotLock up to version 1.3.9 that allows deserialization of untrusted data leading to object injection. This flaw can be exploited remotely without authentication and results in full confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-112863 is a reflected cross-site scripting (XSS) vulnerability in Hogash KALLYAS affecting versions up to and including 4.25.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This can lead to partial compromise of confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.1 (CVSS 3.1). No patch or remediation information is currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-112855) exists in axiomthemes Redy up to version 1.3.5. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation information is currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-112853) exists in axiomthemes Hallelujah theme versions up to 1.1.1. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges or user interaction required. No patch or remediation details are currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-112847) exists in ThemeREX ZenSoul up to version 1.13. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction.
A vulnerability in the Linux kernel related to the parisc architecture has been resolved by increasing the kernel stack size to 32 KB for 64-bit kernels. This change addresses kernel crashes caused by kernel stack overflows, which were observed during specific workloads such as building the Debian vtk9 package with gcc 17. The issue manifested as kernel panics triggered by low stack detection in interrupt handlers.
A vulnerability in the Linux kernel's DAMON subsystem was resolved involving the use of an unaligned address in damon_ptep_mkold(). This caused an out-of-bounds write during page table walks on arm64 architectures, potentially corrupting adjacent memory or causing kernel crashes. The issue was triggered by the kernel selftest suite and could lead to kernel faults or silent memory corruption depending on the memory page permissions. The fix ensures a page-aligned address is used in the affected function, preventing the out-of-bounds access.
A use-after-free (UAF) vulnerability in the Linux kernel's overlay filesystem (ovl) was fixed in the ovl_do_mkdir() function. The issue occurs because ovl_do_mkdir() prints the input dentry after calling vfs_mkdir(), which may free or replace the dentry, leading to a UAF when CONFIG_OVERLAY_FS_DEBUG is enabled. The fix involves printing the dentry before the call and only printing the result afterward.
A vulnerability in the Linux kernel's netfs subsystem related to missing allocation tagging of direct mempool allocations has been resolved. The issue caused warnings and missing allocation tags when CONFIG_MEM_ALLOC_PROFILING_DEBUG was enabled, affecting memory allocation tracking during CIFS mount operations. The fix involves wrapping direct allocation calls with proper allocation tagging hooks to ensure correct profiling and avoid warnings.
A vulnerability in the Linux kernel's drm/xe component related to the adjust_idledly() function has been resolved. The function had multiple issues including a divide-by-zero error when an unrecognized crystal clock caused a zero timestamp base, and integer overflow problems in tick-to-nanosecond conversions. These issues could cause kernel panics or repeated warnings during initialization. The fix involves early returns to avoid divide-by-zero, using 64-bit arithmetic to prevent overflow, and careful clamping of delay values to avoid invalid programming of hardware registers.
A vulnerability in the Linux kernel's KVM arm64 nested virtualization implementation was resolved by fixing the lifecycle management of the nested_mmus array. This array holds shadow page tables used during nested guest execution. Previously, if a VCPU_INIT event occurred while a virtual CPU was running a nested context and the nested_mmus array needed relocation, the vCPU could continue using a pointer to a freed structure, leading to use-after-free conditions. The fix changes the nested_mmus array to an array of pointers allocated at VM creation to avoid reallocations and clarifies object lifecycles.
A vulnerability in the Linux kernel's Rust IRQ handling was resolved by changing how RegistrationInner is passed as a cookie to request_irq. The issue involved accessing uninitialized memory in the IRQ callback due to the IRQ being enabled before RegistrationInner was fully initialized. This flaw was fixed by ensuring RegistrationInner's fields are initialized before passing it as the IRQ cookie. The vulnerability does not affect mainline Linux kernels where a related commit removed the problematic pattern.
A vulnerability in the Linux kernel USB hub driver related to USB3 root hubs has been resolved by reducing the post-resume hold time from 200ms to 120ms. The previous 200ms hold time could trigger an issue on AMD platforms, causing crashes when Android adb repeatedly polls and wakes the USB subsystem. The fix optimizes the hold time for USB3 root hubs without affecting external hubs, improving stability and preventing crashes.
A vulnerability in the Linux kernel's perf subsystem allowed users with kernel profiling privileges to bypass intended permission checks when requesting kernel callchain data. The flaw was due to an incomplete permission check that did not enforce kernel profiling privilege for kernel callchain collection when kernel sampling was excluded. This issue has been resolved by updating the permission checks to properly gate kernel callchain requests, preventing unprivileged access.