CVE-2026-11421

CVE-2026-11421 affects the ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support WordPress plugin. All versions up to 1.17.4 are vulnerable to authenticated SQL Injection via the erpadvancefilter parameter due to insufficient escaping and direct interpolation into a single-quoted ...

CVE-2026-25289

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

CVE-2026-25289

CVE-2026-25289 describes memory corruption/stack-based overflow when processing Device Capability Extended attributes in NAN Service Discovery Frames with invalid length values in WLAN firmware. The issue is tied to the firmware image referenced in the August 2026 Qualcomm security bulletin; no e...

EUVD-2026-52737

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

CVE-2026-25289 Stack-based Buffer Overflow in WLAN Firmware

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

RLSA-2026:49214 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack CVE-2026-43116 kernel: fanotify: fix false...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

CVE-2026-16295

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

CVE-2026-16295

CVE-2026-16295 affects the Clearfy Cache WordPress plugin before 2.4.3. A missing capability check in an admin-page dispatch path lets any authenticated user (e.g., Subscriber) render admin-only settings pages and disclose their contents, including administrative nonces. The canonical page URL st...

EUVD-2026-52597

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

CVE-2026-16295 Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

CVE-2026-16056 Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history...

CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

EUVD-2026-52587

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

EUVD-2026-52512

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

PT-2026-67660

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-16276

The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers...

CVE-2026-16057

The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...

CVE-2026-15254

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...