CVE-2026-106568 ImageMagick: Infinite Loop when reading a crafted XMP profile

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in...

CVE-2026-105139 Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...

CVE-2026-105139 Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...

CVE-2026-105139

The Obot platform (versions 0.26.0 before 0.26.2 ) contains an authorization bypass vulnerability. The root cause is that vMCP profiles were only enforced on tools, failing to restrict access to other elements. This allows authenticated users matching any vMCP profile to access prompts , resource...

CVE-2026-105139 Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...

CVE-2026-87782

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...

CVE-2025-14221

Description 1. CVE-2025-14221 2. Discoverer: Fatma Trabelsi 3. Vendor of Product: SourceCodester 4. Affected Product: Online Banking System 1.0 POC A Stored Cross-Site Scripting XSS vulnerability exists in the User Profile Update functionality of the application. The application fails to properly...

CVE-2026-87782 Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...

CVE-2026-87782

The Koinonia Link WordPress plugin (versions before 1.1.5 , specifically 1.1.2-1.1.4 ) contains a privilege escalation vulnerability. The plugin fails to verify if a user has the necessary permissions to modify roles when saving a role selection during a profile update. This flaw allows any authe...

CVE-2026-87782 Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...

CVE-2026-103681

The Frontend Dashboard WordPress plugin (versions before 3.0.0 ) is vulnerable to an improper access control issue (CWE-284) in one of its AJAX actions . Specifically, the plugin fails to perform a necessary capability check , allowing authenticated users with low privileges, such as subscribers ...

EUVD-2026-94175

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

CVE-2026-103681 Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

WordPress Frontend Dashboard plugin < 3.0.0 - Subscriber+ Profile and Post Field Deletion vulnerability

Subscriber+ Profile and Post Field Deletion vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Frontend Dashboard versions 3.0.0...

CVE-2026-106460

A flaw was found in the @backstage/plugin-auth-node package. This vulnerability allows an authenticated attacker to achieve privilege escalation by assuming another user's catalog identity and gaining their access permissions. The issue occurs because the component does not consistently enforce...

Linux Distros Unpatched Vulnerability : CVE-2026-106576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive wo...

Linux Distros Unpatched Vulnerability : CVE-2026-56851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. CVE-2026-56851 Note that Nessu...

PT-2026-107648

Name of the Vulnerable Software and Affected Versions Nickname profile affected versions not specified Description An issue exists where the Nickname profile can experience a panic due to an out-of-bounds slice error. This occurs when the system attempts to transform specially crafted input into ...

PT-2026-107551

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 ImageMagick versions prior to 6.9.13-57 Description A crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, which prevents the image processing from completing...

PT-2026-107559

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A crafted XMP profile Extensible Metadata Platform, a standard for creating, transferring, and preserving metadata can trigger excessive processing during the determination of a rational value...