🚨 CVE-2026-80754
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
During F55 sensor detection, the transmitter (TX) electrode count was
incorrectly assigned the value of the receiver (RX) electrode count
due to copy-paste typos.
This incorrect value was then propagated to the driver data and used
by F54 to determine the diagnostics report size. On devices with more
RX than TX electrodes, this inflated the perceived TX count, leading
to incorrect report size calculations and potential out-of-bounds
buffer accesses.
Fix the typos by correctly assigning the TX electrode counts.
🎖@cveNotify
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
During F55 sensor detection, the transmitter (TX) electrode count was
incorrectly assigned the value of the receiver (RX) electrode count
due to copy-paste typos.
This incorrect value was then propagated to the driver data and used
by F54 to determine the diagnostics report size. On devices with more
RX than TX electrodes, this inflated the perceived TX count, leading
to incorrect report size calculations and potential out-of-bounds
buffer accesses.
Fix the typos by correctly assigning the TX electrode counts.
🎖@cveNotify
🚨 CVE-2026-11613
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
🎖@cveNotify
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
🎖@cveNotify
Divi Engine
Divi Ajax Filter Changelog
/* CHANGELOG */ VERSION 5.2.4 – 20/08/26 VERSION 5.2.3 – 20/08/26 VERSION 5.2.2 – 20/08/26 VERSION 5.2.1 – 19/08/26 VERSION 5.2.0 – 18/08/26 VERSION 5.1.3 – 11/08/26 VERSION 5.1.2 – 10/08/26 VERSION 5.1.1 – 09/08/26 VERSION 5.1.0 – 06/08/26 VERSION 5.0.0…
🚨 CVE-2026-85408
A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
🚨 CVE-2026-85409
A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file_name leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file_name leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
🚨 CVE-2026-85504
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
🎖@cveNotify
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
🎖@cveNotify
🚨 CVE-2026-85505
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).
🎖@cveNotify
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).
🎖@cveNotify
🚨 CVE-2026-85506
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).
🎖@cveNotify
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).
🎖@cveNotify
🚨 CVE-2026-85507
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).
🎖@cveNotify
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).
🎖@cveNotify
🚨 CVE-2026-85508
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
🎖@cveNotify
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
🎖@cveNotify
🚨 CVE-2026-85509
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
🎖@cveNotify
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
🎖@cveNotify
🚨 CVE-2026-49509
Out-of-bounds read vulnerability in Samsung Opensource Escargot allows Overread Buffers.
This issue affects Escargot: 25648aef19187b3f87f4d9420b8d761453ad4630.
🎖@cveNotify
Out-of-bounds read vulnerability in Samsung Opensource Escargot allows Overread Buffers.
This issue affects Escargot: 25648aef19187b3f87f4d9420b8d761453ad4630.
🎖@cveNotify
GitHub
stb_image: don't deal with fractional ratios by mmaciola · Pull Request #604 · Samsung/rlottie
Apply fix from stb 2.27
🚨 CVE-2025-15691
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.
This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.
🎖@cveNotify
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.
This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.
🎖@cveNotify
WPScan
WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms
See details on WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms CVE 2025-15691. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-15354
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
🎖@cveNotify
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
🎖@cveNotify
ACPT
ACPT Changelog — Version History
Full version history for ACPT: new features, bug fixes, and improvements across every release of the WordPress custom post types framework.
🚨 CVE-2026-16281
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
🎖@cveNotify
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.
🎖@cveNotify
WPScan
Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR
See details on Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR CVE 2026-16281. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-17517
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
🎖@cveNotify
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
🎖@cveNotify
WPScan
Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
See details on Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter CVE 2026-17517. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-19224
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
🎖@cveNotify
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
🎖@cveNotify
WPScan
Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
See details on Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite CVE 2026-19224. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-62928
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
🎖@cveNotify
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
🎖@cveNotify
JOYSOUND.Biz | 業務用カラオケ機器（導入・レンタル）
通信アダプタ CPTrans-ME-X | 業務用カラオケ機器（導入・レンタル）| JOYSOUND.Biz
JOYSOUND 通信アダプタの製品ページです。カラオケ導入ご検討の方は是非ご覧下さい。
🚨 CVE-2026-66840
XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.
🎖@cveNotify
XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.
🎖@cveNotify
JOYSOUND.Biz | 業務用カラオケ機器（導入・レンタル）
通信アダプタ CPTrans-ME-X | 業務用カラオケ機器（導入・レンタル）| JOYSOUND.Biz
JOYSOUND 通信アダプタの製品ページです。カラオケ導入ご検討の方は是非ご覧下さい。
🚨 CVE-2026-69657
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
🎖@cveNotify
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
🎖@cveNotify
JOYSOUND.Biz | 業務用カラオケ機器（導入・レンタル）
通信アダプタ CPTrans-ME-X | 業務用カラオケ機器（導入・レンタル）| JOYSOUND.Biz
JOYSOUND 通信アダプタの製品ページです。カラオケ導入ご検討の方は是非ご覧下さい。
🚨 CVE-2026-70403
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
🎖@cveNotify
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
🎖@cveNotify
JOYSOUND.Biz | 業務用カラオケ機器（導入・レンタル）
通信アダプタ CPTrans-ME-X | 業務用カラオケ機器（導入・レンタル）| JOYSOUND.Biz
JOYSOUND 通信アダプタの製品ページです。カラオケ導入ご検討の方は是非ご覧下さい。
🚨 CVE-2026-71216
PagerDuty alarm hook transmits the integration routing key over cleartext HTTP.
PagerDuty serves this endpoint over HTTPS and will
normally answer plain HTTP with a redirect. That does not remove the exposure.
The initial POST -- including the JSON body containing the routing key -- is
written to the socket unencrypted before any redirect response is received.
Redirection affects only whether the request is retried securely, not whether
the first copy left the host in the clear.
This issue affects Apache SkyWalking: from 9.6.0 through 11.0.0.
Users are recommended to upgrade to version 11.0.0, which fixes the issue.
🎖@cveNotify
PagerDuty alarm hook transmits the integration routing key over cleartext HTTP.
PagerDuty serves this endpoint over HTTPS and will
normally answer plain HTTP with a redirect. That does not remove the exposure.
The initial POST -- including the JSON body containing the routing key -- is
written to the socket unencrypted before any redirect response is received.
Redirection affects only whether the request is retried securely, not whether
the first copy left the host in the clear.
This issue affects Apache SkyWalking: from 9.6.0 through 11.0.0.
Users are recommended to upgrade to version 11.0.0, which fixes the issue.
🎖@cveNotify