CVE-2025-14469 Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the msupdate AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged...

EUVD-2026-51709

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

CVE-2026-18206

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...

CVE-2026-14843

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to...

CVE-2026-18206 Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...

CVE-2026-18206

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...

EUVD-2026-51414

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to...

CVE-2026-14843

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to...

CVE-2026-66416

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

EUVD-2026-51258

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...

CVE-2026-14227

The CVE-2026-14227 entry describes an API session-management vulnerability in MikroTik RouterOS when the API is enabled. The flaw allows an active session to retain its previous permission set after inactivity timeouts or user-group changes, meaning an authenticated user whose permissions have be...

CVE-2026-14227 Insufficient session expiration in MikroTik RouterOS

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...

EUVD-2026-51199

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-14519

IBM App Connect Enterprise (versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27) is affected by CVE-2026-14519, a path traversal flaw that could allow a remote attacker to read arbitrary files. The issue is described as a path traversal vulnerability in the product’s file handling, with a base CVS...

CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-11782

CVE-2026-11782 affects the Points and Rewards for WooCommerce WordPress plugin prior to 2.10.1. The vulnerability stems from missing authorization checks on wallet/points update actions that are reachable by unauthenticated users and do not verify account ownership, allowing arbitrary modificatio...