CVE-2026-18057 Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

EUVD-2026-57097

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

PT-2026-71022

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

CVE-2026-18366: Improper Privilege Management

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...

PT-2026-71024

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...

CVE-2026-18057: Improper Neutralization of Special Elements used in an SQL Command

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

Linux Distros Unpatched Vulnerability : CVE-2026-68174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the...

CVE-2026-68174

A flaw was found in the Linux kernel's tracing subsystem. When handling dynamic events, a memory collision occurs where a reference counter is mistakenly interpreted as a module pointer. This can happen when filtering or setting events for a specific module without properly checking the event's...

WordPress WP Events Manager has a vulnerability related to insufficient validation of data authenticity.

WordPress WP Events Manager is a WordPress plugin used for creating, managing, and displaying events such as meetings, courses, and performances. It supports calendar views, registration, ticket sales, and integration with location maps. There is a vulnerability in WordPress WP Events Manager...

CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

UBUNTU-CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-56847

A flaw in the Node.js Permission Model allows traceevents.createTracing.enable to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure. Mitigation Avoid using the traceevents.createTracing.enable function in...

CVE-2026-68174

The vulnerability CVE-2026-68174 affects the Linux kernel tracing subsystem. In struct trace_event_call, the module pointer and the refcnt atomic share a union, so for dynamic events (kprobe, uprobe, fprobe, eprobe, wprobe) the refcnt may be non-zero and cause call-&gt;module to appear as a small...

CVE-2026-68174 tracing: Fix union collision of module and refcnt for dynamic events

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

EUVD-2026-55275

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68174 tracing: Fix union collision of module and refcnt for dynamic events

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-72690

CVE-2026-72690 | Attendize : An improper authorization vulnerability allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer’s events via POST /event/{event_id}/question/create. The root cause is that postCreateEventQuestion loads the target ...

EUVD-2026-55003

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-14211: Authorization Bypass Through User-Controlled Key

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...