CVE-2026-13414

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

WordPress CMP plugin < 4.1.18 - Unauthenticated Maintenance Mode Disable vulnerability

Unauthenticated Maintenance Mode Disable vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.18...

CVE-2026-13414

The CMP - Coming Soon & Maintenance WordPress plugin (versions before 4.1.18 ) is vulnerable to an unauthenticated maintenance mode disable vulnerability. The root cause is a lack of authorization checks on one of its AJAX actions, specifically cmp_disable_comingsoon_ajax. Furthermore, the plugin...

CVE-2026-13414 CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

CVE-2026-13414 CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

EUVD-2026-66867

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

SUSE CVE-2026-72497

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than t...

The vulnerability of the Secure Kernel Mode mode in Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Secure Kernel Mode feature in Windows operating systems is related to improper checking of consistency in input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2026-13414: Missing Authorization

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

PT-2026-82383

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

PT-2026-82651

Name of the Vulnerable Software and Affected Versions GNU C Library versions prior to 2.46 Description A heap buffer overflow can occur in the fopen function when an effectively empty string is passed to the ,ccs= syntax extension of the mode argument, provided the mode string is controlled by an...

CVE-2026-18374: Out-of-bounds Write

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

PT-2026-82575

Name of the Vulnerable Software and Affected Versions Dash MCP server affected versions not specified Description In network mode, the server binds its listener to the loopback address but fails to verify the host name of incoming requests. Within src/mcp server dash.py, the server is configured...

Linux Distros Unpatched Vulnerability : CVE-2026-18374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may...

EUVD-2026-66677

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...

bubblewrap: bubblewrap: Privilege escalation via ptrace when installed in setuid mode

A flaw was found in bubblewrap when operating in setuid mode. A local user may use ptrace to interfere with the sandbox setup process and gain access to privileged operations that are normally restricted. This could allow an attacker to bypass intended sandboxing restrictions and potentially...

cakephp/debug_kit: MailPreview contains unsafe reflection

Impact The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true: 1. debug mode must be enabled. 2. The hostname must match a 'local' domain or be in an allowlist. Patches 5.2.4 and 4.10.3 contai...

CVE-2026-80579

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...

UBUNTU-CVE-2026-80579

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...

CVE-2026-74741

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...