CVE-2026-93265

A flaw was found in the Linux kernel's TC9563 power control driver. When parsing device tree nodes for the integrated Ethernet endpoint during device initialization, the driver improperly processes multiple functions, causing an out-of-bounds array access. A local attacker capable of supplying or...

CVE-2026-101054 Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function getfile of the file /tmp/wpasupplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available...

CVE-2026-101054

A vulnerability exists in the Thinkware U3000 (versions up to 1.02.04 ) within the TCP Service component. The flaw is located in the get_file function of the /tmp/wpa_supplicant.conf file, where improper access controls allow for remote exploitation. This vulnerability can lead to unauthorized ac...

CVE-2026-101053 Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

CVE-2026-101053

The Thinkware U3000 (up to version 1.02.04 ) contains a vulnerability in the TCP Service component. Specifically, the PUT_FILE function involving the file /tmp/wpa_supplicant.conf is susceptible to improper access controls when an attacker manipulates the argument path . This flaw can be exploite...

CVE-2026-101053 Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

WordPress Groups – Memberships and Access Control plugin <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Groups versions = 4.6.0...

WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aydan Arabadzha in WordPress Plugin MakeCommerce for WooCommerce versions = 4.1.0...

WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by c4st1e in WordPress Plugin WordPress Backup & Migration versions = 1.6.0...

EUVD-2026-88134

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ashish Agarwal @Donrulezz in WordPress Plugin GravityExport Lite for Gravity Forms versions = 2.7.2...

Malware in @wbnr/design-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @wbnr/lottiefiles-loader

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in swiper_angular

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in api-typings

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ultra-ws

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

Malware in spotify-url-resolvers

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in discord-players

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...