SUSE CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-41187

Summary: Calico’s apiserver fails to invoke the Delete override for DeleteCollection on tier-scoped policies (NetworkPolicy, GlobalNetworkPolicy and staged variants). This allows a user with deletecollection or wildcard verbs on tier-scoped policy resources to bulk-delete policies in tiers they w...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

EUVD-2026-51154

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-14221

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...

CVE-2026-15382 Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-14222

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-64392

A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to bypass filesystem permission checks during 'delete-on-close' operations. Specifically, when a file handle is torn down, the base-file unlink and extended attribute xattr removal operations...

PT-2026-66468

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

EUVD-2025-210556

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

PT-2026-66583

Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0 Description An issue exists that allows SQL Injection via the '/delete members.php' endpoint through the id parameter. SQL Injection is a technique where malicious SQL statements are inserted...

PT-2026-66581

Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0 Description An issue exists that allows SQL Injection via the /delete membership.php endpoint through the id variable. SQL Injection is a technique where malicious SQL statements are inserted...

CVE-2025-69934

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

EUVD-2025-210557

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...

PT-2026-66381

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2025-69934

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...

CVE-2025-69931

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...

RHEL 9 : kernel-rt (RHSA-2026:47632)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47632 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

CVE-2025-69931

The CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the /delete_membership.php?id=1 endpoint. This vulnerability, identified as CVE-2025-69931 , stems from the improper neutralization of special elements used in an SQL command. The impact is rated as CRITICAL with a C...