10005 matches found
CVE-2026-15304
The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'POpluginpath' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the performpluginsearch function, where escsql output is passed as the...
CVE-2026-16774
The CVE-2026-16774 entry concerns the WordPress Chatbot plugin vulnerable to Missing Authorization via the wpcs_send_email() AJAX handler in versions up to and including 8.5.9. The wpcs_send_email() function is registered for both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without...
CVE-2026-58348
A flaw was found in Moodle. Missing capability checks in the report builder fragment callbacks could allow authenticated users to retrieve report data that they are not authorized to access. This could lead to information disclosure...
CVE-2026-14821
The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...
CVE-2026-12124
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...
EUVD-2026-49700
The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...
CVE-2026-14821
The CVE-2026-14821 entry concerns the Quiz and Survey Master (QSM) WordPress plugin, affected up to version 11.1.4 (i.e., before 11.1.5). The root cause is a missing capability check when deleting output templates in the plugin, which permits users with contributor-level access and above to delet...
CVE-2026-14821 Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion
The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...
CVE-2026-14821
The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...
CVE-2026-12124
CVE-2026-12124 affects the PDFDraft WordPress plugin (versions up to and including 1.1.0). The issue is a missing capability check on serveTemplatePdfAjax() and a REST route registered with permission_callback => '__return_true' on /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf, allowing ...
PT-2026-65388
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...
PT-2026-65392
The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...
CVE-2026-64539 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...
CVE-2026-64539 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: ppp: The requirement for CAPNETADMIN in the target netns is necessary for unattached IOCTls. The opening of /dev/ppp is currently allowed for file-fcred-userns, while unattached administrative IOCTls operate on...
BIT-OPENBAO-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when...
UBUNTU-CVE-2026-64472
In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same...
CVE-2026-64472
The CVE-2026-64472 entries describe a Linux kernel fix for vfio/mlx5: a racy bitfield layout was tightened by splitting bitfields and moving certain flags to dedicated storage units. The root cause was non-atomic bitfield operations using read-modify-write patterns, which could lead to concurrent...
PT-2026-64613
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run...
CVE-2026-8789
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...