Total
398119 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-79619 | 2026-08-28 | N/A | N/A | ||
| On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed. | |||||
| CVE-2026-61898 | 2026-08-28 | N/A | 7.8 HIGH | ||
| The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method. | |||||
| CVE-2026-77113 | 2026-08-28 | N/A | N/A | ||
| Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files. | |||||
| CVE-2026-61897 | 2026-08-28 | N/A | 7.8 HIGH | ||
| An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation. | |||||
| CVE-2026-78273 | 2026-08-28 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions. | |||||
| CVE-2026-81271 | 2026-08-28 | N/A | 8.8 HIGH | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions. | |||||
| CVE-2026-78281 | 2026-08-28 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions. | |||||
| CVE-2026-78261 | 2026-08-28 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions. | |||||
| CVE-2026-27330 | 2026-08-28 | N/A | 8.6 HIGH | ||
| Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions. | |||||
| CVE-2026-81277 | 2026-08-28 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. | |||||
| CVE-2026-32564 | 2026-08-28 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | |||||
| CVE-2026-78292 | 2026-08-28 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions. | |||||
| CVE-2026-78283 | 2026-08-28 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions. | |||||
| CVE-2026-78293 | 2026-08-28 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions. | |||||
| CVE-2026-81274 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| Subscriber Broken Access Control in Ditty <= 3.1.67 versions. | |||||
| CVE-2026-81491 | 2026-08-28 | 7.5 HIGH | 7.3 HIGH | ||
| A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file src/index.ts. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-81279 | 2026-08-28 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions. | |||||
| CVE-2026-78257 | 2026-08-28 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions. | |||||
| CVE-2026-78271 | 2026-08-28 | N/A | 7.2 HIGH | ||
| Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions. | |||||
| CVE-2026-81202 | 2026-08-28 | 7.5 HIGH | 7.3 HIGH | ||
| A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. | |||||