CVE-2026-21058

Improper input validation in Samsung Contacts (pre-SMR Aug-2026 Release 1) lets local attackers delete files using the app's privileges. NVD rates it HIGH (CVSS 7.1, local/low-complexity), while Samsung rates it MEDIUM (6.9). No in-the-wild exploitation is reported. Apply the SMR Aug-2026 Release...

CVE-2026-21058

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

CVE-2026-21058

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-17540

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

EUVD-2026-55000

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077

The Duplicate Post WordPress plugin (versions before 1.5.5 ) is vulnerable to an authenticated arbitrary post deletion flaw. The root cause is a lack of per-object authorization checks during the plugin's bulk copy and delete operations. This allows any user granted access to the plugin by an adm...

EUVD-2026-55010

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

EUVD-2026-55041

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

CVE-2026-17540

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

PT-2026-69375

Name of the Vulnerable Software and Affected Versions RSS Aggregator by Feedzy versions prior to 5.2.6 Description The plugin fails to verify if the requesting user owns or has permission to edit the specified import job. This allows users with author-level access or higher to permanently delete...

CVE-2026-72567: Improper Limitation of a Pathname to a Restricted Directory

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

PT-2026-69914

Name of the Vulnerable Software and Affected Versions Vault Enterprise versions prior to 2.0.4 Vault Enterprise versions prior to 1.21.9 Vault Enterprise versions prior to 1.20.14 Vault Enterprise versions prior to 1.19.20 Description The identity entity batch-delete endpoint is subject to a...

PT-2026-69378

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.9 Description An issue exists where a cookie value is not sanitized before being used in SQL queries. This cookie is processed on every request without authentication or capability checks, allowing...

PT-2026-69934

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. An authenticated user with permissions to create or delete certificates can exploit a path traversal issue. The apiCreateCertificate schema in...

CVE-2026-17540: Improper Access Control

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

PT-2026-69666

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drm/xe component of the Linux kernel. An imported dma-buf Buffer Object BO is created as a ttm bo type sg BO that references the exporter's reservati...

CVE-2026-18934: Incorrect Authorization

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...