CVE-2026-93803 wifi: libipw: fix key index receive bound checks

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

EUVD-2026-86184

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix an off-by-1 boundary check Before looking at the 11th byte, check the length is big enough...

CVE-2026-93797 wifi: iwlwifi: mvm: fix an off-by-1 boundary check

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix an off-by-1 boundary check Before looking at the 11th byte, check the length is big enough...

CVE-2026-93797 wifi: iwlwifi: mvm: fix an off-by-1 boundary check

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix an off-by-1 boundary check Before looking at the 11th byte, check the length is big enough...

CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-79759

The web-based server management platform Termix (versions 1.7.0 through 2.5.1) is vulnerable to cross-user information disclosure due to a missing ownership check in the POST /credentials/:id/deploy-to-host endpoint. Located in src/backend/database/routes/credentials.ts, the application fails to ...

CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

EUVD-2026-86154

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

CVE-2026-93282 ksmbd: fix maximum allowed access checks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

CVE-2026-93282 ksmbd: fix maximum allowed access checks

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

CVE-2026-4806

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the saveoption function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or...

CVE-2026-4806

The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable in all versions up to and including 1.1.2 . The root cause is a missing capability check on the save_option() function, which allows unauthenticated attackers to perform unauthorized settings export or settings reset (de...

CVE-2026-3253

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.7.21 . The root cause is a missing capability check on the forms() method of the AdminController class. This vulnerability allows authenticated attack...

CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

poc

T4 PoC — @shopify/theme-check-node auto-glob RCE Shopify Th...

CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

Malicious Package

Overview poly-check-b is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-97855

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0 through 4.1.5 Description An authentication bypass exists in the public two-factor authentication 2FA verification flow. An unauthenticated attacker can take over any account that has 2FA enabled, including administrato...

Linux Distros Unpatched Vulnerability : CVE-2026-93803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path...