CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-82842

The SAML Single Sign On WordPress plugin (versions before 6.0.0 ) is vulnerable to an unauthenticated privilege escalation flaw. The root cause is that the plugin fails to honor configured criteria for linking incoming single sign-on identities to WordPress accounts, instead always resolving iden...

CVE-2026-82842 SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identit...

CVE-2026-82842 SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identit...

EUVD-2026-83667

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identit...

PT-2026-95932

Name of the Vulnerable Software and Affected Versions TikTok WordPress plugin versions prior to 1.4.2 Description An issue exists where the plugin fails to verify if a request is authorized before processing a sign-in code provided in the URL. This allows any visitor to force the site to redeem a...

CVE-2026-92965: Missing Authorization

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

CVE-2026-92410: Cross-Site Request Forgery (CSRF)

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-82842: Improper Privilege Management

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identit...

PT-2026-95920

Name of the Vulnerable Software and Affected Versions SAML Single Sign On WordPress plugin versions prior to 6.0.0 Description The plugin fails to honor the configured criterion for linking an incoming single sign-on identity to a WordPress account. It always resolves the identity by login name...

PT-2026-95927

Name of the Vulnerable Software and Affected Versions Sign-up Sheets versions prior to 2.4.0 Description The Sign-up Sheets WordPress plugin fails to properly validate the CSRF nonce protecting the sign-up deletion action. This allows an attacker to delete sign-up records by sending a forged...

SUSE CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

Linux Distros Unpatched Vulnerability : CVE-2026-90195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign- extension for signed 1-byte and 2-byte kfunc args...

CVE-2026-54907 Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

EUVD-2026-82468

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-54907

Caddy Proxy Manager , a web interface for managing Caddy Server reverse proxies and certificates, enabled email and password self-registration by default (at /api/auth/sign-up/email) prior to version 1.5.1 . This allowed an unauthenticated remote actor to create an active account with the user ro...

DEBIAN-CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-90195

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

DEBIAN-CVE-2026-90195

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...