CVE-2026-19389 Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...

PT-2026-69518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tcp check req function within the SYN-RECEIVED request-socket path. The system accepts an in-window RST Reset packet without requiring the SEG.SEQ variable to...

The vulnerability of the smp_cmdPairingReq() function in the net/bluetooth/smp.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smpcmdPairingReq function in the net/bluetooth/smp.c module of the Linux operating system is related to insufficient security checks for protected connections. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Linux Distros Unpatched Vulnerability : CVE-2026-68148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies...

PT-2026-69948

Name of the Vulnerable Software and Affected Versions npm-check-updates versions prior to 23.0.3 Description An issue exists where an attacker can embed arbitrary terminal control characters within the homepage or repository URL fields of a dependency's package.json file. When a developer execute...

The vulnerability in the `drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c` file of the Broadcom wireless adapter driver for the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c file of the Broadcom wireless adapter driver for the Linux operating system is related to an improper check of a specified index, position, or offset in the input data. Exploiting this vulnerability could allow an...

Linux Distros Unpatched Vulnerability : CVE-2026-68247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range...

Linux Distros Unpatched Vulnerability : CVE-2026-68253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow...

PT-2026-69969

Name of the Vulnerable Software and Affected Versions shim application affected versions not specified Description A NULL pointer vulnerability exists in the dp.c library of the shim application. This issue occurs due to a missing NULL pointer check, which could allow an attacker to cause a denia...

PT-2026-69978

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.112.0 ERPNext versions prior to 16.22.0 Description Authenticated users with limited privileges can modify protected data beyond their assigned roles because certain functions omit required write permission checks...

Eopi-Hunt-Skill

Eopi-Hunt-Skill Authorized security research toolkit comb...

CVE-2026-17017

The CVE-2026-17017 entry concerns the CubeWP Framework WordPress plugin prior to 1.1.31. The vulnerability arises because a parameter is not properly sanitized/escaped before being used in a SQL statement via an AJAX action, and there is no capability check on that action. This enables users with...

CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

EUVD-2026-54884

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18465

The CVE concerns the WP MAPS PRO WordPress plugin (before version 6.1.3). Vulnerability: lack of a capability check in an AJAX action that is accessible to unauthenticated users, combined with improper validation of a user-controlled path used in a file inclusion. This allows an unauthenticated a...

CVE-2026-18465 WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

EUVD-2026-54878

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

EUVD-2026-54891

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it...

CVE-2026-16992 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it...