Vuldb Updates

A vulnerability was found in Linux Kernel up to 7.2.3. It has been classified as very critical. This impacts the function madvise_free_huge_pmd of the file mm/huge_memory of the component Huge Memory. Performing a manipulation results in race condition. This vulnerability is reported as CVE-2026-93218. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.3. Impacted is the function print_page_owner_memcg of the component mm/page_owner. The manipulation leads to time-of-check time-of-use. This vulnerability is listed as CVE-2026-93216. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 7.2.3 and classified as problematic. The impacted element is the function madvise_cold_or_pageout_pte_range of the component Device-Private PMD Handler. This manipulation causes race condition. This vulnerability is registered as CVE-2026-93217. The attack needs to be launched locally. No exploit is available. The affected component should be upgraded.

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This impacts the function cdx_create_res_attr of the component cdx. Such manipulation of the argument res_attr leads to double free. This vulnerability is listed as CVE-2026-93215. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 7.2.3. The affected element is the function usbg_make_tpg of the component f_tcm. The manipulation results in improper locking. This vulnerability is cataloged as CVE-2026-93214. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 7.2.3. The impacted element is the function of_alias_scan of the component Stem Parser. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-93213. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. It has been classified as critical. Affected by this issue is the function nfsd_file_net_dispose of the component nfsd. The manipulation leads to null pointer dereference. This vulnerability is documented as CVE-2026-93212. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability classified as critical has been found in Linux Kernel up to 6.1.187/6.6.156/6.12.108/6.18.49/7.2.3. The affected element is the function get_tgt_name of the component SMB Client DFS Cache. The manipulation of the argument tgthint leads to null pointer dereference. This vulnerability is referenced as CVE-2026-93210. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. This affects the function shrinker_register of the component nfsd. This manipulation causes use after free. This vulnerability is tracked as CVE-2026-93211. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 6.6.156/6.12.108/6.18.49/7.2.3. This affects the function kasan_quarantine_remove_cache of the file mm/slub.c of the component KASAN. This manipulation causes race condition. This vulnerability is handled as CVE-2026-93208. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.1.117/6.6.156/6.12.108/6.18.49/7.2.3. This vulnerability affects the function __hci_cmd_sync_sk of the component hci_core. Such manipulation of the argument req_skb leads to use after free. This vulnerability is uniquely identified as CVE-2026-93209. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability categorized as problematic has been discovered in Linux Kernel up to 7.2.3. Affected by this issue is the function proc_bus_pci_read of the file /proc of the component PCI Procfs. The manipulation of the argument f_cred results in improper privilege management. This vulnerability is known as CVE-2026-93206. Attacking locally is a requirement. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.6.156/6.12.108/6.18.49/7.2.3. This issue affects the function svcauth_gss_decode_credbody of the component SUNRPC. Performing a manipulation results in use after free. This vulnerability was named CVE-2026-93207. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.108/6.18.49/7.2.3. Impacted is the function arm_smmu_device_remove of the component arm-smmu-v3. Executing a manipulation can lead to use after free. The identification of this vulnerability is CVE-2026-93205. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability was found in Siemens SIMATIC S7-PLCSIM, SIMATIC STEP 7 Safety, SIMATIC STEP 7, SIMATIC WinCC Unified, SIMATIC WinCC, SIMOCODE ES, SIMOTION SCOUT TIA, SINAMICS Startdrive, SIRIUS Safety ES and TIA Portal Cloud. It has been classified as very critical. This affects an unknown function. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2024-49849. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as very critical has been discovered in Siemens SIMATIC S7-PLCSIM, SIMATIC STEP 7 Safety, SIMATIC STEP 7, SIMATIC WinCC Unified, SIMATIC WinCC, SIMOCODE ES, SIMOTION SCOUT TIA, SINAMICS Startdrive, SIRIUS Safety ES and TIA Portal Cloud. Affected by this vulnerability is an unknown functionality of the component User Setting Handler. Such manipulation leads to improper input validation. This vulnerability is referenced as CVE-2024-52051. It is possible to launch the attack remotely. No exploit is available.

A vulnerability, which was classified as critical, was found in Siemens SIMATIC S7-PLCSIM V17, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18, SIMATIC STEP 7 V19, SIMATIC STEP 7 V20, SIMATIC WinCC V17, SIMATIC WinCC V18, SIMATIC WinCC V19, SIMATIC WinCC V20, SIMOCODE ES V17, SIMOCODE ES V18, SIMOCODE ES V19, SIMOCODE ES V20, SIMOTION SCOUT TIA V5.4, SIMOTION SCOUT TIA V5.5, SIMOTION SCOUT TIA V5.6, SIMOTION SCOUT TIA V5.7, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SINAMICS Startdrive V19, SINAMICS Startdrive V20, SIRIUS Safety ES V17, SIRIUS Safety ES V18, SIRIUS Safety ES V19, SIRIUS Safety ES V20, SIRIUS Soft Starter ES V17, SIRIUS Soft Starter ES V18, SIRIUS Soft Starter ES V19, SIRIUS Soft Starter ES V20, TIA Portal Cloud V17, TIA Portal Cloud V18, TIA Portal Cloud V19 and TIA Portal Cloud V20. Affected is an unknown function of the component Project File Parser. Such manipulation leads to deserialization. This vulnerability is listed as CVE-2025-40759. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability was found in Siemens SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, SIMATIC S7-PLCSIM V17, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18, SIMATIC STEP 7 V19, SIMATIC STEP 7 V20, SIMATIC WinCC V17, SIMATIC WinCC V18, SIMATIC WinCC V19, SIMATIC WinCC V20, SIMOCODE ES V17, SIMOCODE ES V18, SIMOCODE ES V19, SIMOCODE ES V20, SIMOTION SCOUT TIA V5.4, SIMOTION SCOUT TIA V5.5, SIMOTION SCOUT TIA V5.6, SIMOTION SCOUT TIA V5.7, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SINAMICS Startdrive V19, SINAMICS Startdrive V20, SIRIUS Safety ES V17, SIRIUS Safety ES V18, SIRIUS Safety ES V19, SIRIUS Safety ES V20, SIRIUS Soft Starter ES V17, SIRIUS Soft Starter ES V18, SIRIUS Soft Starter ES V19, SIRIUS Soft Starter ES V20, TIA Portal Cloud V17, TIA Portal Cloud V18, TIA Portal Cloud V19, TIA Portal Cloud V20 and TIA Portal Test Suite V20. It has been rated as critical. This issue affects some unknown processing of the component Interprocess Communication Handler. This manipulation causes deserialization. This vulnerability appears as CVE-2024-54678. The attack requires local access. There is no available exploit. Upgrading the affected component is advised.

A vulnerability was found in Featured Image from URL FIFU Plugin up to 5.2.7 on WordPress. It has been classified as critical. Affected by this vulnerability is the function get_all_urls. This manipulation causes sql injection. This vulnerability is tracked as CVE-2025-10036. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in Featured Image from URL FIFU Plugin up to 5.2.7 on WordPress. It has been rated as problematic. This affects an unknown part of the component Log File Handler. Performing a manipulation results in information disclosure. This vulnerability is cataloged as CVE-2025-9985. It is possible to initiate the attack remotely. There is no exploit available.