CVE-2026-79700: Reliance on Untrusted Inputs in a Security Decision

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optinform addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon...

CVE-2026-73668: Incorrect Authorization

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector...

CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is required to exploit this vulnerability. Furthermore, only systems with ksmbd enabled are vulnerable. The specific flaw exists within the handling of shareconf objects...

CVE-2026-74933 GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CVE-2026-74933

The GenieWords WordPress plugin, versions 1.5.27 through 1.5.34 , is affected by missing authorization checks on several of its REST API and AJAX actions. Because the plugin decodes stored values before outputting them, an unauthenticated attacker can overwrite the plugin's configuration and inje...

CVE-2022-42917

In FRRouting FRR before 8.5, the service user usually frr can escalate its privileges to root by monitoring the configuration directory /etc/frr and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dnsmasq (UTSA-2026-091426)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091426 advisory. A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens ...

CVE-2026-74933: Missing Authorization

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CLSA-2026-1789201689 TuxCare security update for commons-configuration:commons-configuration (1 CVE)

TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.2...

CVE-2026-84024

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page...

WordPress BEAR plugin < 1.2.2 - Meta Field Configuration Update vulnerability

Meta Field Configuration Update vulnerability discovered by Ali Mousavi in WordPress Plugin BEAR versions 1.2.2...

EUVD-2026-76791

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page...

CVE-2026-84024 BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page...

CVE-2026-84024

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce WordPress plugin, in versions prior to 1.2.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a failure to verify a CSRF nonce before saving the plugin's meta field configuration . An attacker...

EUVD-2026-76738

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

EUVD-2026-76748

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-84024: Cross-Site Request Forgery (CSRF)

The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page...

Linux Distros Unpatched Vulnerability : CVE-2026-89562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenev...

Linux Distros Unpatched Vulnerability : CVE-2026-89773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The...