Vuldb Updates

A vulnerability, which was classified as very critical, has been found in Fortinet FortiMail up to 7.2.9/7.4.8/7.6.6/8.0.1. This affects an unknown part. This manipulation causes path traversal. This vulnerability is tracked as CVE-2026-104286. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability was found in FasterXML jackson-dataformats-binary. It has been classified as problematic. Affected by this vulnerability is the function SmileParser._handleLongFieldName of the component Smile parser. This manipulation causes resource consumption. This vulnerability appears as CVE-2026-68496. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in Feedzy RSS Aggregator Plugin up to 5.1.0 on WordPress. It has been declared as critical. This affects the function feedzy_sanitize_feeds. Executing a manipulation can lead to server-side request forgery. This vulnerability is registered as CVE-2025-11128. It is possible to launch the attack remotely. No exploit is available.

A vulnerability labeled as critical has been found in TESI Gandia Integra Total 4.4.2236.1. The affected element is an unknown function of the file /encuestas/integraweb[_v4]/integra/html/view/comprimir.php of the component ZIP File Handler. Such manipulation leads to path traversal. This vulnerability is traded as CVE-2025-41073. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability described as problematic has been identified in Molgenis EMX2 11.14.0. This affects an unknown function of the component URL Handler. Executing a manipulation can lead to open redirect. This vulnerability is handled as CVE-2025-10355. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in Bold Page Builder Plugin up to 5.4.5 on WordPress and classified as problematic. This affects an unknown part. Performing a manipulation of the argument percentage results in cross site scripting. This vulnerability is identified as CVE-2025-7730. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in LLM Hubspot Blog Import Plugin up to 1.0.1 on WordPress. It has been rated as critical. Affected is the function process_save_blogs of the component AJAX Endpoint. The manipulation leads to missing authorization. This vulnerability is referenced as CVE-2025-11257. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in AI Chatbot Free Models Plugin up to 1.6.5 on WordPress. It has been declared as critical. This issue affects the function newcodebyte_chatbot_export_messages of the component CSV File Handler. Such manipulation leads to csv injection. This vulnerability is uniquely identified as CVE-2025-11576. The attack can be launched remotely. No exploit exists.

A vulnerability was found in Edge-Themes Edge CPT Plugin up to 1.4 on WordPress. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in improper control of filename for include/require statement in php program. This vulnerability was named CVE-2025-62868. The attack may be initiated remotely. There is no available exploit.

A vulnerability labeled as critical has been found in Dell Storage Manager up to 2020 R1.20. Affected by this vulnerability is an unknown functionality of the component DSM Data Collector. Such manipulation leads to improper authentication. This vulnerability is referenced as CVE-2025-43995. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability classified as problematic was found in Password Policy Manager Plugin up to 2.0.5 on WordPress. Impacted is the function moppm_ajax of the component AJAX Endpoint. Such manipulation leads to missing authorization. This vulnerability is referenced as CVE-2025-11255. It is possible to launch the attack remotely. No exploit is available.

A vulnerability, which was classified as critical, has been found in Light & Wonder Deck Mate 2. This impacts an unknown function. The manipulation leads to missing immutable root of trust in hardware. This vulnerability is referenced as CVE-2025-34502. It is possible to launch the attack on the physical device. No exploit is available.

A vulnerability labeled as critical has been found in Aksis Netty ERP. This affects an unknown function. The manipulation results in sql injection. This vulnerability is identified as CVE-2025-11253. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability classified as very critical was found in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc1. This vulnerability affects the function mpi3mr_sas_port_add of the component mpi3mr. The manipulation results in improper update of reference count. This vulnerability is reported as CVE-2026-98128. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc1. This issue affects the function mpi3mr_sas_port_add of the component mpi3mr. This manipulation causes null pointer dereference. This vulnerability appears as CVE-2026-98129. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc1. This affects the function timer_reduce of the component sctp. The manipulation results in use after free. This vulnerability is identified as CVE-2026-98130. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc1. This affects the function cirrus_pci_probe of the file drivers/gpu/drm/tiny/cirrus-qemu.c of the component cirrus-qemu. Executing a manipulation can lead to memory corruption. This vulnerability appears as CVE-2026-98142. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc1. Impacted is the function resp_worker of the component qaic. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-98155. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc1. Affected by this vulnerability is the function queue_rq of the component nvme-rdma. The manipulation results in use after free. This vulnerability is reported as CVE-2026-98154. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.110/6.18.52/7.2.6/7.3-rc2 and classified as critical. Affected is the function ppp_receive_nonmp_frame of the file net/core/skbuff.c of the component ppp_async. The manipulation of the argument rpkt results in out-of-bounds read. This vulnerability is known as CVE-2026-98158. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.