CVE-2026-98168
— smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In cifs_query_reparse_point(), the start >= end check before…
Oct 06, 2026
Oct 21, 2026
Oct 06, 2026
Oct 21, 2026
CVE-2026-98167
— smb: client: fix server->total_read for compound encrypted PDUs
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix server->total_read for compound encrypted PDUs
In receive_encrypted_standard(), server->total_read is left at th…
Oct 06, 2026
Oct 19, 2026
Oct 06, 2026
Oct 19, 2026
CVE-2026-98166
— drm/ttm: fix swapped-out resources never leaving their bulk_move range
In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: fix swapped-out resources never leaving their bulk_move range
ttm_tt_swapout() returns the number of pages swapped out o…
Oct 06, 2026
Oct 19, 2026
Oct 06, 2026
Oct 19, 2026
CVE-2026-97308
— WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.
Remote
|
Authentication
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-95594
— WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerabil…
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications…
Remote
|
Authentication
Oct 06, 2026
Oct 12, 2026
Oct 06, 2026
Oct 12, 2026
CVE-2026-95526
— WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-95105
— Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery b…
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make i…
cloak
|
Remote
|
Cryptography
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-94675
— WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vuln…
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-94206
— Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured sec…
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-62072
— WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-4889
— SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies
SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to bo…
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-48199
— WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
Remote
|
Authorization
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-48197
— WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a t…
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42638
— WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digi…
Oct 06, 2026
Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
CVE-2026-42637
— WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerabil…
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
Remote
|
Authentication
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42636
— WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site…
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42635
— WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulne…
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42634
— WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.…
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42418
— WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: f…
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
CVE-2026-42417
— WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
