EUVD-2026-115717

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-113421 ThreadX Modules invokes trace-full callbacks after module unload

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-113421

Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 are vulnerable to a Use After Free (CWE-416) issue within ThreadX Modules . The flaw occurs because the system fails to revoke a module's trace-buffer-full callback upon stopping and unloading the module. If event tracing is enabled and a kernel...

SUSE-SU-2026:5077-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed bsc1284043. - CVE-2026-42528: memory calculation bug in moddav allows an attacker with permission to creat...

SUSE-SU-2026:5076-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed bsc1284043. - CVE-2026-42528: memory calculation bug in moddav allows an attacker with permission to creat...

Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

Synology is urging customers to update the DiskStation Manager DSM software powering its Network Attached Storage NAS devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated...

WordPress Advanced Custom Fields: Extended PRO plugin <= 0.9.2.6 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Advanced Custom Fields: Extended PRO versions = 0.9.2.6...

kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period

A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 CVSS score: 10.0, is a case of missing authentication for a critical function that could be exploited by an...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.45 security and extras update

Red Hat OpenShift Container Platform release 4.20.45 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

CVE-2026-120577

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

CVE-2026-120559

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefdremoveuploadedfile function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete...

CVE-2026-120518

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxpimagefieldupdateonuseractivation calling unlink on a path built from visitor-supplied signup metadata with no realpath resolution, no...

CVE-2026-120577

The FluentCart WordPress plugin (all versions up to and including 1.6.2 ) is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function. Authenticated attackers with custom-level access and above can exploit this to delete arbitrary files on the serv...

CVE-2026-120577 FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

EUVD-2026-115671

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

CVE-2026-120534 Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the renderfield function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing ...

CVE-2026-120534

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in versions up to and including 0.9.2.6 . The flaw exists in the render_field function due to insufficient validation of form configuration parameters before they are merged into field settings a...

EUVD-2026-115665

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefdremoveuploadedfile function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete...

CVE-2026-120559 Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefdremoveuploadedfile function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete...