CVE-2025-10005: Authorization Bypass Through User-Controlled Key

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

AZL-96246 CVE-2026-74509 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix advertising data UAFs hcifindadvinstance returns an advinfo pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some...

CVE-2026-19891 TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

CVE-2026-19891

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

EUVD-2026-59607

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

CVE-2026-72279

The CVE-2026-72279 entry concerns the Linux kernel KVM arm64 implementation for the L1 VNCR mapping. The fix ensures that the host stage-1 mapping respects the read-only status of the guest PFN by caching PFN writability in the VNCR TLB and using this to constrain fixmap permissions. If a guest t...

PT-2026-72886

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-WLC100 version 2.05b02 Description An issue exists in the IKE Phase 1 Aggressive Mode component within the /etc/racoon.conf file. Manipulation of the exchange mode argument leads to a failure in encrypting sensitive data. This fla...

CVE-2026-19891: Missing Encryption of Sensitive Data

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. This manipulation of the argument exchangemode causes missing encryption of sensitive data. It is possible to initiate the...

40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin

On July 14th, 2026, we received a submission for an Authentication Bypass vulnerability in User Profile Builder, a WordPress plugin with more than 40,000 active installations. This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically th...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

EUVD-2026-58719

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-33818

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

[SECURITY] [DSA 6440-1] unzip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6440-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 14, 2026 https://www.debian.org/security/faq -...

Uncontrolled Recursion

Overview std/encoding/asn1 is a Go standard library package std/encoding/asn1 Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report:Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-72666

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

CVE-2026-72661

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint...

CVE-2026-72664

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

CVE-2026-72629

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. The result is disclosure of inference output from a trained model in a different space that the user is not authoriz...

CVE-2026-16868

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing...

CVE-2026-16868 IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing...