CVE-2026-15667

CVE-2026-15667 CVE-2026-15667 WordPress Event Solution LFI POC Eventin plugin de WordPress wp-event-solution ≤ 4.1.22 — inclusión de archivos locales autenticada Contributor+ a través del campo REST eventlayout. Solo para pruebas autorizadas. No ejecutes esto contra sistemas que no sean de tu...

CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

UBUNTU-CVE-2026-98113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

CVE-2026-69146

A flaw was found in MLflow, an open-source AI engineering platform. An authenticated user could bypass authorization controls by sending requests to the LogInputs endpoint for another user's data. This allowed the user to inject unauthorized data records into the dataset lineage metadata, leading...

CVE-2026-69148

A flaw was found in MLflow, an open-source AI engineering platform. Insufficient validation in the CreateModelVersion function allows an authenticated user to create a model version that references another user's artifact directory. This enables the authenticated user to read files from that...

CVE-2026-98113 ksmbd: rate limit unmapped SID errors

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin BP Better Messages versions = 3.0.4...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin GeoDirectory versions = 2.8.183...

CVE-2026-92573

Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a...

CVE-2026-6082

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...

CVE-2026-6083

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6087

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6085

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6086

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6084

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...

WordPress wpForo Forum plugin <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin wpForo Forum versions = 3.1.6...

CVE-2026-6088 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

EUVD-2026-86625

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6088

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile software by Novadigits technologies. The flaw is located in the REST endpoint /inventory/configuration/categories within the API and management panel. It allows an authenticated attacker to inject and persist malicious Jav...

CVE-2026-6087 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...