SUSE CVE-2026-91104

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

SUSE CVE-2026-91105

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

SUSE CVE-2026-91106

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-15947: Missing Authorization

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of...

PT-2026-95782

Name of the Vulnerable Software and Affected Versions Metasync versions prior to 2.6.24 Description The Metasync plugin for WordPress allows unauthorized modification of data because the save instant indexing settings function lacks a capability check. The function is registered on the admin init...

PT-2026-95766

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.2 Description The plugin fails to verify if a booking belongs to the requesting user before allowing modifications or deletions. This allows a user with...

PT-2026-95785

Name of the Vulnerable Software and Affected Versions VW Writer Blog theme for WordPress versions prior to 1.3.9 Description The software allows unauthorized modification of data because the vw writer blog reset all settings function lacks a proper capability check. Authenticated users with...

CVE-2026-2278: Missing Authorization

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vwwriterblogresetallsettings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2026-92403: Incorrect Authorization

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...

CVE-2026-92421: Authorization Bypass Through User-Controlled Key

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...

PT-2026-95784

Name of the Vulnerable Software and Affected Versions Ibtana – Ecommerce Product Addons versions prior to 0.4.7.8 Description Authenticated users with Subscriber-level access and above can perform unauthorized post meta modification. This is caused by a missing capability check on the 'iepa use g...

CVE-2026-1984: Missing Authorization

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

WordPress Partial Shipment for WooCommerce plugin <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Settings Modification vulnerability discovered by Muhan Luo in WordPress Plugin Woocommerce Partial Shipment versions = 3.4...

WordPress Datalogics Ecommerce Delivery – Datalogics plugin <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Datalogics Ecommerce Delivery versions = 2.6.65...

CVE-2026-91203 Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

CVE-2026-93854

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...

WordPress Search Atlas SEO – OTTO AI SEO Automation for WordPress plugin <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Whitelabel Password Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Search Atlas SEO versions = 2.6.23...

WordPress Search Atlas SEO – OTTO AI SEO Automation for WordPress plugin <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Site-Wide Option Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Search Atlas SEO versions = 2.6.23...

CVE-2026-93854

In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations PUT /v2/leases/leaseid and DELETE /v2/leases/leaseid. The policy authorize wrapper attempts to load the target lease to build the authorization target from its owner...

WordPress Flex Import plugin <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Flex Import versions = 3.0...