CVE Watch401,677 in full archive

Vulnerabilities exploitable today

16,520in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,666

Distribution · last window

Critical
3,401
High
15,534
Medium
14,799
Low
1,422

Filters

Window

Severity

Flags

Vulnerabilities11,321–11,360 · 16,520

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-981718.8 HIG

42.3%

——13In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames: - Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.4d CVE-2026-98170—

9.3%

——3In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds. Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".4d CVE-2026-981697.1 HIG

36.5%

——11In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.4d CVE-2026-98168—

9.3%

——3In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.4d CVE-2026-98167—

11.4%

——3In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server->total_read for compound encrypted PDUs In receive_encrypted_standard(), server->total_read is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifs_handle_standard() passes this full size to smb2_check_message(), causing the PDU length guards to incorrectly validate the entire compound frame instead of the current sub-PDU. This allows truncated non-last sub-PDUs to bypass length validation, leading to out-of-bounds reads in smb2_get_data_area_len(). Fix this by setting server->total_read to the true length of the current sub-PDU: next_cmd for non-last sub-PDUs, and the remaining pdu_length for the last one.4d CVE-2026-981667.8 HIG

4.2%

——1In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk_move range ttm_tt_swapout() returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit b2ed01e7ad3d ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") moved the bulk_move bookkeeping in ttm_bo_swapout_cb() under "if (!ret)", so the ttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail() pair is now skipped on every successful swapout. The equivalent change for the shrinker in commit 1d59f36e95f7 ("drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure") tests "lret > 0", which is what was intended here as well. Before b2ed01e7ad3d the resource was taken off the bulk_move before the swapout; since then a swapped-out resource stays inside its BO's bulk_move range (and on the manager LRU) although it is unevictable. When it is later freed or the BO leaves the bulk_move (ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()), ttm_resource_del_bulk_move() skips it because of its !ttm_resource_unevictable() guard, so a range endpoint in pos->first / pos->last is left pointing at freed memory. The next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor is a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(), "list_del corruption" in ttm_resource_move_to_lru_tail() or a NULL dereference in ttm_resource_manager_next() -- minutes to hours after a hibernation, or at process exit / reboot following one. Samuel Ainsworth's analysis of drm/amd issue 5387 (see Link) identified the dangling cursor; the missing removal at swapout time is the reason it dangles. Testing the condition for success restores the removal. On an AMD Phoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on a 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug crashed 5 of 18 hibernation cycles; a function profile of one hibernation showed 336 ttm_tt_swapout() calls and zero ttm_resource_del_bulk_move_unevictable() calls. With this change the removal happens for every swapped-out resource and 12 further cycles were clean.4d CVE-2026-98165—

4.3%

——1Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.4d CVE-2026-973084.8 MED

8.4%

——3Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.17d CVE-2026-955948.1 HIG

13.8%

——4Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.17d CVE-2026-955267.3 HIG

12.9%

——4Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.17d CVE-2026-95105—

1.5%

——0Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward.17d CVE-2026-946757.1 HIG

8.3%

——3Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.17d CVE-2026-94206—

16.3%

——5Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.17d CVE-2026-66588—

20.9%

——6Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive.10d CVE-2026-620728.8 HIG

26.0%

——8Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.17d CVE-2026-4889—

21.4%

——6SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.17d CVE-2026-481997.5 HIG

32.4%

——10Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.17d CVE-2026-481977.2 HIG

39.0%

——12Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.17d CVE-2026-426387.5 HIG

17.2%

——5Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.7.1 versions.17d CVE-2026-426376.5 MED

25.1%

——8Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.17d CVE-2026-426367.1 HIG

15.7%

——5Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.17d CVE-2026-426357.1 HIG

15.6%

——5Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.17d CVE-2026-426347.1 HIG

15.6%

——5Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.17d CVE-2026-424187.1 HIG

15.6%

——5Unauthenticated Cross Site Scripting (XSS) in Social Rocket <= 1.3.5 versions.17d CVE-2026-424179.3 CRI

24.2%

——7Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.17d CVE-2026-424168.5 HIG

20.4%

——6Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.17d CVE-2026-424159.3 CRI

15.1%

——5Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.17d CVE-2026-424148.5 HIG

20.4%

——6Subscriber SQL Injection in ListingPro <= 2.9.12 versions.17d CVE-2026-424137.5 HIG

23.2%

——7Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.17d CVE-2026-415627.5 HIG

23.2%

——7Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.17d CVE-2026-415617.5 HIG

23.2%

——7Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.17d CVE-2026-415607.5 HIG

21.4%

——6Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.17d CVE-2026-415597.5 HIG

23.2%

——7Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.17d CVE-2026-415559.3 CRI

15.1%

——5Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.17d CVE-2026-408077.1 HIG

8.3%

——3Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.17d CVE-2026-408067.1 HIG

8.3%

——3Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.17d CVE-2026-397986.5 MED

15.8%

——5Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.17d CVE-2026-397979.8 CRI

25.7%

——8Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.17d CVE-2026-397967.5 HIG

21.4%

——6Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.17d CVE-2026-397959.3 CRI

24.2%

——7Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.17d