Vuldb Updates

A vulnerability identified as critical has been detected in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. The identification of this vulnerability is CVE-2026-112081. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as very critical was found in Red Hat Enterprise Linux, Hardened Images and OpenShift Container Platform. This affects an unknown function. Executing a manipulation can lead to improper privilege management. The identification of this vulnerability is CVE-2026-16487. The attack may be launched remotely. There is no exploit available.

A vulnerability labeled as critical has been found in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. This vulnerability is referenced as CVE-2026-112082. It is possible to launch the attack remotely. Furthermore, an exploit is available. The pull request to fix this issue awaits acceptance.

A vulnerability marked as problematic has been reported in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. This vulnerability is identified as CVE-2026-112083. The attack can be initiated remotely. Additionally, an exploit exists. The pull request to fix this issue awaits acceptance.

A vulnerability was found in HPE Compute Scale-up Server 3200, Compute Scale-up Server 3250 and Superdome Flex Server. It has been declared as problematic. This vulnerability affects unknown code of the component RMC Filesystem. Executing a manipulation can lead to improper input validation. This vulnerability is registered as CVE-2026-76739. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in ActiveTrail for WooCommerce Plugin up to 1.2.6 on WordPress. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to missing authorization. This vulnerability is documented as CVE-2026-106028. The attack can be initiated remotely. There is not any exploit available.

A vulnerability identified as problematic has been detected in Blaze Demo Importer Plugin up to 1.0.16 on WordPress. The affected element is an unknown function of the component SVG File Handler. This manipulation causes cross site scripting. This vulnerability appears as CVE-2026-106933. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability labeled as problematic has been found in FormFlow for GoHighLevel Plugin up to 1.0.0 on WordPress. The impacted element is an unknown function. Such manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-89286. The attack may be launched remotely. There is no exploit available.

A vulnerability marked as problematic has been reported in ElementsReady Addons for Elementor Plugin up to 6.7.2 on WordPress. This affects an unknown function. Performing a manipulation results in missing authorization. This vulnerability is known as CVE-2026-91047. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as critical has been found in ElementsReady Addons for Elementor Plugin up to 6.7.2 on WordPress. Affected is an unknown function of the component Settings Save Handler. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2026-91046. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as critical has been discovered in Gateway for Vantiv Plugin up to 1.0.1 on WordPress. Impacted is an unknown function of the component Hosted-Payment Return Handler. The manipulation results in improper access controls. This vulnerability is reported as CVE-2026-106014. The attack can be launched remotely. No exploit exists.

A vulnerability labeled as critical has been found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. This vulnerability is known as CVE-2026-112086. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is best practice to apply a patch to resolve this issue.

A vulnerability described as problematic has been identified in Snap Finance Plugin up to 3.11.0 on WordPress. This impacts an unknown function. Executing a manipulation can lead to missing authorization. This vulnerability is handled as CVE-2026-94273. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Linux Kernel up to 6.6.150/6.12.102/6.18.43/7.1.7/7.2-rc5. It has been rated as problematic. This affects the function idxd_cdev_open of the component idxd. The manipulation leads to deadlock. This vulnerability is uniquely identified as CVE-2026-74574. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is advised.

A vulnerability identified as very critical has been detected in Linux Kernel up to 6.18.49/7.2.3. The impacted element is the function smc_llc_rmt_delete_rkey/smc_llc_save_add_link_rkeys of the file net/smc of the component SMC-Rv2 LLC. The manipulation of the argument wr_rx_buf_v2 leads to buffer overflow. This vulnerability is documented as CVE-2026-80985. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. This affects the function message_receive of the file net/iucv/af_iucv.c of the component iucv. Such manipulation leads to use after free. This vulnerability is listed as CVE-2026-68140. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability was found in Linux Kernel up to 6.18.33/7.0.10 and classified as problematic. The affected element is the function idpf_ptp_init of the component Idpf. Such manipulation of the argument read_dev_clk_lock leads to missing initialization of a variable. This vulnerability is uniquely identified as CVE-2026-64162. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.33/7.0.10. This issue affects the function ieee80211_ml_epcs of the component Mac80211. Such manipulation of the argument link_id leads to out-of-bounds read. This vulnerability is documented as CVE-2026-64030. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.92/6.18.34/7.0.11 and classified as very critical. This affects the function hci_dev_close_sync of the component hci_sync. Such manipulation leads to privilege escalation. This vulnerability is documented as CVE-2026-63974. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability marked as critical has been reported in Linux Kernel up to 7.0.11. Impacted is an unknown function of the component Mxuport. The manipulation leads to memory corruption. This vulnerability is listed as CVE-2026-63899. The attack must be carried out locally. There is no available exploit. It is suggested to upgrade the affected component.