CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search

EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the address-book search API. Users with record access can query address-book search to obtain email addresses even when Roles restrict the...

CVE-2026-90060

A flaw was found in the Linux kernel's ALSA control module. A local user could create a write-only kcontrol element without a get callback. This could lead to a null pointer dereference in the LED layer, causing a system crash and resulting in a denial of service...

CVE-2026-90132

A flaw was found in the Linux kernel's NTFS filesystem. This vulnerability allows an unprivileged local user to bypass intended access controls by modifying reserved extended attributes xattrs, such as $LXUID, $LXGID, $LXMOD, and $LXDEV, through the setxattr function. This unauthorized modificati...

CVE-2026-90099

A flaw was found in the Linux kernel's network scheduler. An unprivileged user can exploit a memory accounting vulnerability in the traffic control tc classifier. By creating a large number of filters, an attacker can cause the kernel to pin memory outside of memory cgroup memcg limits, leading t...

CVE-2026-90081

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. This vulnerability occurs due to a synchronization issue in the congestion control mechanism. A remote attacker could exploit this by causing a sender to become indefinitely blocked on a congested port, leading to a...

openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon sshd incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by...

Malware in @chatest/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Hackers heat up supermarket fridges, spoiling food across France

A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold. The attack caused significant financial losses and food waste. Some installations reportedly reached temperatures of around 50°...

WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin User Registration versions = 5.2.8...

Product Walkthrough: Bitdefender AI Visibility and Control

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine...

CVE-2026-109699

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8...

CVE-2026-109696

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0...

CVE-2026-109684

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-108496

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.24...

CVE-2026-108492

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3...

CVE-2026-108493

Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1...

CVE-2026-108174

Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4...

CVE-2026-106597

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8...

CVE-2026-109699 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8...

CVE-2026-109699 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8...