CVE-2026-105059

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

CVE-2026-105059 WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

EUVD-2026-93085

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

CVE-2026-105059 WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

CVE-2026-105059

The Delete All Comments of wordpress plugin for WordPress versions

Authorization Bypass

langgraphsdk is vulnerable to an authorization bypass. The vulnerability is due to the @auth.on.threads, @auth.on.assistants, and @auth.on.crons decorators ignoring the specified actions argument, which allows an authenticated attacker to bypass fallback permission or ownership checks and read,...

SysmonEoP

SysmonEoP Prueba de concepto para el borrado/escritura arbitrario de archivos en Sysmon CVE-2022-41120/CVE-2022-44704 Vulnerabilidad La vulnerabilidad se encuentra en el código responsable del evento ClipboardChange, al que se puede acceder a través de RPC. Los usuarios locales pueden enviar dato...

CVE-2026-57830

Helix Ultimate Framework — Lectura/Eliminación Arbitraria de Archivos/Carpetas mediante Path-Traversal no Autenticado Esto es una vulnerabilidad confirmada de DoS + acceso al sistema de archivos entre inquilinos cross-tenant, NO RCE. Una teoría de escalada a RCE borrar configuration.php para volv...

PT-2026-106852

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries...

CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...

PT-2026-106385

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

PT-2026-106615

In the Linux kernel, the following vulnerability has been resolved: drop monitor: use timer shutdown sync to prevent timer rearming during teardown In drop monitor teardown paths net dm trace off set, net dm hw monitor stop, and error unwind paths in net dm trace on set and net dm hw monitor star...

PT-2026-107111

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

PT-2026-106742

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro rpc port. Attackers can send forged requests with the force flag set to bypa...

Linux Distros Unpatched Vulnerability : CVE-2026-87975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the...

PT-2026-107293

The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...

PT-2026-107294

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachment id also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match. Patches Patch available in pymongo = 4.18.1 Workarounds Ensure your existing workflow on...

GHSA-8FVV-FGR5-F8CH pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match. Patches Patch available in pymongo = 4.18.1 Workarounds Ensure your existing workflow on...