SUSE CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-41187

Summary: Calico’s apiserver fails to invoke the Delete override for DeleteCollection on tier-scoped policies (NetworkPolicy, GlobalNetworkPolicy and staged variants). This allows a user with deletecollection or wildcard verbs on tier-scoped policy resources to bulk-delete policies in tiers they w...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

EUVD-2026-51154

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

Grafana Snapshot - Authentication Bypass

Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by...

CVE-2026-14221

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

CVE-2026-64392

A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to bypass filesystem permission checks during 'delete-on-close' operations. Specifically, when a file handle is torn down, the base-file unlink and extended attribute xattr removal operations...

EUVD-2025-210556

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

CVE-2025-69934

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

PT-2026-66468

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

CVE-2025-69934

The CVE-2025-69934 entry concerns CodeAstro Membership Management System 1.0 and has a concrete flaw: SQL Injection in /delete_members.php?id=1. The issue is tied to the delete_members.php parameter handling, with CVSS 3.1 metrics showing a Network attack vector, no privileges required, no user i...

CVE-2025-69931

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...

CVE-2025-69931

CVE-2025-69931 affects CodeAstro Membership Management System 1.0. A SQL Injection vulnerability is exposed in the endpoint /delete_membership.php?id=1, enabling an attacker to potentially manipulate the database. The CVSS v3.1 base score is 9.8 (CRITICAL), with impact on confidentiality, integri...

EUVD-2025-210557

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...

CVE-2026-13268 G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-5060

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

PT-2026-65857

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.41 Linux kernel versions prior to 6.12.100 Linux kernel versions prior to 6.6.147 Linux kernel versions prior to 6.1.180 Linux kernel versions prior to 5.15.213 Linux kernel versions prior to 5.10.262...

CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...