CVE-2026-15260

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...

CVE-2026-12872

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

libXfont2: PCF Font Parsing Heap Buffer Overflow

A flaw was found in libXfont2. A specially crafted PCF Portable Compiled Format font file, when processed by libXfont2, can lead to a buffer overflow. This occurs because the font parsing process does not properly validate the size of a bitmap buffer against the glyph metrics provided in the...

pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

Important: Red Hat Security Advisory: pipewire security update

An update for pipewire is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code

Three high-severity security flaws have been disclosed in Hugging Face's Diffusers library that could allow crafted model repositories to stealthily execute arbitrary code on machines that load it, opening the artificial intelligence AI supply chain to security risk. "These vulnerabilities are...

CVE-2026-6695

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...

CVE-2026-4793

CVE-2026-4793 affects Synology Assistant prior to 7.0.7-50095. The issue is an incorrect default permissions vulnerability that lets local users read or write arbitrary files and can cause a denial-of-service during installation. Affected component: Synology Assistant (client-side utility) with l...

CVE-2026-16563 Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16564

The CVE-2026-16564 entry concerns the Dokan plugin (WordPress) prior to 5.0.9. The REST endpoint that handles bulk order-status changes does not verify order ownership, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders be...

CVE-2026-16060 Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload

The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code executi...

EUVD-2026-52178

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

CVE-2026-16250

The CVE concerns the Personal QR Message WordPress plugin (version

CVE-2026-16300

Affected software: ChamaWP WordPress plugin prior to version 1.0.13. Issue: password reset requests are not properly validated, enabling unauthenticated attackers to reset passwords for arbitrary users (including administrators) and potentially take over the site. Root cause: insufficient validat...

EUVD-2026-52181

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-16300

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-16250 Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...

CVE-2026-15260

The CVE-2026-15260 entry applies to the GEO my WP WordPress plugin prior to 4.5.5.3. The root cause is missing ownership/capability checks on two logged-in AJAX actions, enabling users with subscriber-level access or higher to modify or permanently delete geolocation records belonging to other us...