CVE-2026-19049

CVE-2026-19049 affects the ProSolution WP Client WordPress plugin prior to 2.0.9. The vulnerability arises because a cookie value is not sanitised before use in SQL queries and the cookie is processed on every request without authentication or capability checks, enabling unauthenticated users to ...

CVE-2026-18469

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...

CVE-2026-18468

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-18468 Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-18468

CVE-2026-18468 affects the WordPress plugin Login & Register Forms (before 4.0.2). The vulnerability arises because the password reset verification state is not bound to the target account or verifier, but to a client-controllable value. This allows unauthenticated attackers who recently complete...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames

A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion,...

xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow

A flaw was found in the glamorfontget function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by...

xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow

A flaw was found in the glamorfontget function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by...

Linux Distros Unpatched Vulnerability : CVE-2026-68388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: handle overlapping allocated ranges in fallocate smb3simplefallocaterange can skip holes when an allocated range returned by the server starts befor...

The vulnerability of the smb2_compound_op() function in the fs/smb/client/smb2inode.c module, which is part of the SMB client support in Linux kernel, allows a attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the smb2compoundop function in the fs/smb/client/smb2inode.c module, which is part of the SMB client support in Linux kernel, relates to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the...

Important Photon OS Security Update - PHSA-2026-5.0-92-0948

Updates of 'samba-client' packages of Photon OS have been released...

PT-2026-69980

Name of the Vulnerable Software and Affected Versions CyberChef versions prior to 11.3.0 Description The pretty-recipe parser in src/core/Utils.mjs can cause client-side CPU exhaustion when processing a malformed recipe= URL fragment containing numerous unmatched quote characters. This occurs whe...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

EUVD-2026-54882

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The CVE affects the InfiniteWP Client WordPress plugin (before 1.13.6). Root cause: it does not properly verify the site-connection state or the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. Impact: unauthenticated attackers can bind their own ke...

[SECURITY] Fedora 44 Update: nghttp2-1.68.0-5.fc44

This package contains the HTTP/2 client, server and proxy programs...

Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd82004d1cbf2e4b6a3c77f48293b0d9638fe59592eb40291b6a332121f6fe6 Package contains no code paths that read installer secrets, fetch and execute remote content, relay caller data to third-party destinations, or...