PT-2026-90574

I discovered a CSRF vulnerability in BEAR – Bulk Editor and Products Manager Professional for WooCommerce. CVE-2026-84023 — Taxonomy Term Modification via CSRF Affected versions: 1.2.2 Fixed in: 1.2.2 https://t.co/VqYeibaeDi BugBounty CyberSecurity CVE WordPress...

PT-2026-90557

Name of the Vulnerable Software and Affected Versions CODE MONKEYS PROPOSALS versions prior to 1.0.2 Description The plugin fails to validate user-supplied file paths before performing file deletion and does not verify the permissions of the user making the request. This allows any authenticated...

PT-2026-90580

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site'...

PT-2026-90590

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own...

PT-2026-90591

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

PT-2026-90589

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range...

Linux Distros Unpatched Vulnerability : CVE-2026-89439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

Linux Distros Unpatched Vulnerability : CVE-2026-89560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this...

Linux Distros Unpatched Vulnerability : CVE-2026-89450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field span...

Linux Distros Unpatched Vulnerability : CVE-2026-89593

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, unmaphugepagerange can adjust reservations. In the case of folio mapped i...

Linux Distros Unpatched Vulnerability : CVE-2026-89630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 cifs: Remove the RFC1002 header from smbhdr changed the quantity this bound ...

Linux Distros Unpatched Vulnerability : CVE-2026-89525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the...

Linux Distros Unpatched Vulnerability : CVE-2026-89701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into...

Linux Distros Unpatched Vulnerability : CVE-2026-81003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport heade...

Linux Distros Unpatched Vulnerability : CVE-2026-89566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jbd2: check needresched when skipping busy checkpoint buffers journalshrinkonecplist skips busy checkpoint buffers when called with JBD2SHRINKBUSYSKIP. The...

Linux Distros Unpatched Vulnerability : CVE-2026-89492

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an...

CVE-2026-89525

A flaw was found in the Linux kernel. A local attacker could craft a malicious Universal Disk Format UDF image to trigger an out-of-bounds read vulnerability in the udfgetpblockvirt15 function. This occurs when the system attempts to read a Virtual Allocation Table VAT index equal to the entry...

CVE-2026-89610

A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted mapping pairs array. This could lead to memory corruption and...

CVE-2026-89694

A flaw was found in the Linux kernel's NFSv4.2 server nfsd. An authenticated NFSv4.2 client could exploit a vulnerability in the managecpntfstate function by guessing a state identifier. This improper ownership check allows the client to cancel and free another client's copy-notify stateid, leadi...

CVE-2026-89439

A flaw was found in the Linux kernel's Intel Speed Select Technology ISST driver. A missing NULL check for isstcommon.sstinst during failed socket loading could allow a local attacker to trigger a NULL pointer dereference. This vulnerability could lead to a system crash, resulting in a Denial of...