73556 matches found
EUVD-2026-64215
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
CVE-2026-14187 Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
CVE-2026-14187
The Tutor LMS WordPress plugin versions before 4.0.6 is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the plugin fails to enforce per-object ownership checks on its course content type. This allow users with the instructor role to unauthorizedly read the conte...
CVE-2026-19883
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
EUVD-2026-64207
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-19883
The WPeMatico RSS Feed Fetcher WordPress plugin (all versions up to and including 2.8.24 ) is vulnerable to privilege escalation due to a missing capability check on the wpematico_import_settings function. An authenticated attacker with subscriber-level access or above can update arbitrary WordPr...
SUSE CVE-2026-15686
Adminer multiquery Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the...
SUSE CVE-2026-68282
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Add missing error check for platformgetresource Add missing error check for platformgetresource return value to prevent NULL pointer dereference when memory resource is not available...
PT-2026-79605
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the user page-table accounting paths where page table check set and page table check clear functions incorrectly account shared zero-page PTEs and huge zero PMDs as...
CVE-2026-74676: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...
PT-2026-79577
Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description The order plugin fails to perform necessary access checks, allowing unauthenticated users to reorder rows. Recommendations Update to version 4.7.2 or later...
PT-2026-79502
Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.25 Description The plugin is susceptible to unauthorized data modification leading to privilege escalation. This occurs because the wpematico import settings function lacks a proper capability...
PT-2026-79625
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2-rc6 Description An issue exists in the network scheduler where the act gact and act police components fail to properly range check fallback control actions supplied by user space. Specifically, the TCA GACT...
Linux Distros Unpatched Vulnerability : CVE-2026-74649
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's...
Linux Distros Unpatched Vulnerability : CVE-2026-74717
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the...
PT-2026-79539
Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8 Description Cross-site request forgery occurs in the 'releaseVideoNow.json.php' endpoint because it lacks authenticity checks and accepts GET requests. An attacker can craft a malicious cross-site...