Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fixed the issue to cover normal cluster writes using cprwsem. When we overwrite a compressed cluster with a normal cluster, we should not unlock cprwsem during f2fswriterawpages. Otherwise, data will be corrupted ...

CVE-2026-104645 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104645 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin, in versions prior to 3.6.14 , contains an authorization bypass vulnerability. The root cause is the failure to properly verify ownership on several gallery and image management actions, either by checking ownership against the wrong objec...

SUSE CVE-2026-78411

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-78411

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-78411

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-78411

The Velociraptor platform contains a vulnerability in the SetClientMetadata function due to an incorrect authorization check (CWE-863). This flaw allows a user possessing only the LABEL_CLIENTS permission to update server metadata , which typically contains site-wide configuration data intended o...

EUVD-2026-92523

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

CVE-2026-78411 Velociraptor Server Metadata update with Insufficient Permission Check

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

PT-2026-106043

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...

EUVD-2026-88316

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

CVE-2026-93540

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability

Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

CVE-2026-16292

The Frontend File Manager Plugin for WordPress (versions through 23.6 ) contains a vulnerability where it fails to perform nonce validation on specific file-metadata update actions. This oversight allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack to modify the metadata of a...

CVE-2026-16292 Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest...

EUVD-2026-51947

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest...

CVE-2026-16292 Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest...

CVE-2026-16292: Cross-Site Request Forgery (CSRF)

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest...

PT-2026-67108

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.7 Description The plugin fails to perform nonce validation—a security measure used to protect against Cross-Site Request Forgery CSRF, where a user is tricked into executing unwanted actions—on...