CVE-2026-104033: Off-by-one Error

A flaw was found in SSSD. When configured to enforce account expiration using LDAP Lightweight Directory Access Protocol shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass...

CVE-2026-94278: Improper Access Control

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

ROS-20261006-73-0146

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0183

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-95526: Missing Authorization

Unauthenticated Broken Access Control in BEAR = 1.2.2 versions...

PT-2026-107145

Name of the Vulnerable Software and Affected Versions Arista CloudVision CUE versions prior to 2026.2.1 Description An access-control flaw in the CV-CUE backend allows an unauthenticated network attacker to access functionality intended only for internal services. This may lead to the exposure of...

PT-2026-106454

Unauthenticated Broken Access Control in 10Web Social Photo Feed = 1.4.35 versions...

PT-2026-106792

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description An attacker can submit a request to a specific update endpoint to modify collection documents. This occurs when orderable is enabled on a collection ...

CVE-2026-39762: Missing Authorization

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1...

ROS-20261006-73-0161

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0168

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0132

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0165

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106808

Name of the Vulnerable Software and Affected Versions @payloadcms/db-mongodb versions prior to 3.87.0 @payloadcms/db-mongodb canary versions prior to 4.0.0-canary.20 Description An authenticated user with permissions to update a document can modify fields that should be restricted by field-level...

CVE-2026-92821: Return of Wrong Status Code

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP Lightweight Directory Access Protocol environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote...

ROS-20261006-73-0223

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106484

Unauthenticated Broken Access Control in Sermon'e = 1.0.2 versions...

ROS-20261006-73-0207

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the IB/isert component of the Linux kernel. The isert send done function offloads completions for ISTATE SEND TASKMGTRSP, ISTATE SEND REJECT, and...

Security Advisory 0190

Security Advisory 0190 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All of the CVEs covered in this advisory affect only CloudVision-CUE on-premises. CV-CUE is Arista’s Wi-Fi management service and, in on-premises...