CVE-2026-110365

The WPExperts Advanced File Manager (file-manager-advanced) WordPress plugin is vulnerable to a Missing Authorization (CWE-862) flaw in versions up to and including 5.4.14 . This vulnerability allows an attacker to exploit Incorrectly Configured Access Control Security Levels , leading to broken ...

CVE-2026-110365 WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

CLSA-2025-1742471200 kernel: Fix of 21 CVEs

net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - smb: client: fix potential deadlock when releasing mids CVE-2023-52757 - tcp/dccp: Don't use timerpending in reqskqueueunlink. CVE-2024-50154 - ALSA: 6fire: Release resources at card release CVE-2024-53239 - smb: client: fix...

PT-2026-116594

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.13 contains security vulnerabilities. These vulnerabilities arise from a race condition that occurs when canceling requests for the lightning control channel. This race condition causes the tbcfgrequestwork and tbcfgrequest Cancel functions to compete, resulting in the...

CVE-2026-112025: Improper Access Control

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to...

CVE-2026-110880: Missing Authorization

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

CVE-2026-98763: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792362285)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792362285 advisory. - rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious...

PT-2026-116590

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

PT-2026-116982

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.3.0-rc3 Description An issue exists in the USB core where non-zero control endpoints populate both dev-ep inepnum and dev-ep outepnum with the same usb host endpoint pointer during the usb enable endpoint...

PT-2026-128609

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep in and ep out for non-ep0 control endpoints In usb enable endpoint, non-zero control endpoints where usb endpoint xfer control&ep-desc is true populate both dev-ep inepnum and dev-ep outepnum with the sam...

CVE-2026-110383: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

CVE-2026-110035: Improper Access Control

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from...

CVE-2026-110365: Missing Authorization

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

PT-2026-128460

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

PT-2026-116595

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

Linux Distros Unpatched Vulnerability : CVE-2026-98694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free duri...

PT-2026-128571

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erap ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavio...

PT-2026-128612

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill rules kill rules removes mixed AUDIT DIR and AUDIT EXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...