CVE-2026-16759

Tutor LMS (eLearning plugin for WordPress, versions ≤ 4.0.5 ) is vulnerable to unauthenticated Remote Code Execution limited to zero-argument function invocation via the tutor_course_filter_ajax AJAX action. The root cause is a missing authorization check combined with unsanitized array keys pass...

SUSE CVE-2026-72214

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmemdeviceput causing reference leak In cpcapbatterydetectbatterytype, the reference to an nvmem device obtained via nvmemdevicefind is not released with nvmemdeviceput on the success or...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-39070: Improper Neutralization of Input During Web Page Generation

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

EUVD-2026-67902

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

PT-2026-82860

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor course filter ajax AJAX action. This is due to missing authorization on the handl...

PT-2026-83172

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

CVE-2026-39070

The Bit Assist WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in its Call-To-Action feature. This flaw affects versions 1.7.1 and lower , where an authenticated attacker with administrator privileges can insert a malicious payload into a widget's Call-To-Action form field. On...

PT-2026-86725

In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Fix call trace due to missing release When unloading the igen6 edac driver, there is a call trace: Device 'null' does not have a release function, it is broken and must be fixed. See Documentation/core-api/kobject.rst...

CVE-2026-80643: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Fix call trace due to missing release When unloading the igen6edac driver, there is a call trace: Device 'null' does not have a release function, it is broken and must be fixed. See Documentation/core-api/kobject.rst...

Linux Distros Unpatched Vulnerability : CVE-2026-80643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - EDAC/igen6: Fix call trace due to missing release When unloading the igen6edac driver, there is a call trace: Device 'null' does not have a release function, it...

PT-2026-82943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the igen6 edac driver where unloading the driver triggers a call trace. This occurs because the memory controller devices lack a release function, leading to a warning...

Exploit for Use After Free in Mozilla Firefox

CVE-2026-74936 A not fancy reproduction. The baseline require...

CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

PT-2026-82654

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The Tutor LMS WordPress plugin contains a template injection issue caused by insufficient validation of request data. This allows unauthenticated users to overwrite internal variables during templa...

SysComb: Fine-Grained Transparent System Call Filtering for Attack Surface Reduction

Restricting the system calls available to applications shrinks the kernel's attack surface and greatly mitigates the impact of compromised programs. Recent approaches showcase techniques to generate system call filters, however, all existing solutions require either kernel or application...

Escargot 4.3.0-214-gfaee4437 Command Injection

An OS command injection vulnerability exists in the Escargot version 4.3.0-214-gfaee4437 crash handler due to an executable/module path being incorporated into an addr2line shell command without quoting or escaping. The resulting command is executed using system, causing shell metacharacters...

CVE-2026-55182 LibreNMS: Remote Code Execution by Signal Alert Transportation Module

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...

CVE-2026-55182

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...