PT-2026-108857

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3...

PT-2026-108869

Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2...

Towards Safe World Models: Risks, Defenses, and Evaluation

World models support planning, control, learning from imagined experience, and model-mediated evaluation by predicting action-conditioned consequences. Their safety cannot be inferred from predictive accuracy alone: errors in observations, state and memory, dynamics, evaluation, execution, or...

ROS-20261009-73-0541

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0379

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0314

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0221

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0043

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

Apache Tomcat Access Control Bypass

The vulnerability of the Apache Tomcat application server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

Cisco Application Policy Infrastructure Controller Access Control Unauthorized Access

The vulnerability of the Cisco Application Policy Infrastructure Controller APIC management tool is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20261009-73-0246

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261009-73-0458

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261009-73-0479

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-108877

Name of the Vulnerable Software and Affected Versions Restrict User Access – Membership Plugin with Force versions prior to 2.8.2 Description A missing authorization issue exists that allows the exploitation of incorrectly configured access control security levels. Recommendations Update to versi...

CVE-2026-108156: External Control of File Name or Path

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

PT-2026-117995

Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...

CVE-2026-107419: Missing Authorization

Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2...

CVE-2026-96461: Missing Authorization

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

CVE-2026-95589: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n...

CVE-2026-19574: Improper Access Control

The ARM64 MMU back-end allocated address space identifiers ASIDs for memory domains with a bare round-robin counter in archmemdomaininit arch/arm64/core/mmu.c. VMASIDBITS is 8, so only 255 ASIDs exist; once the counter wrapped, archmemdomaininit could hand an ASID to a new domain while a still-li...