CVE-2026-66732 Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

CVE-2026-65551

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...

CVE-2026-65551

CVE-2026-65551 concerns the WordPress WordPress Breakdance plugin (versions up to and including 2.6.1) where a Broken Access Control / Missing Authorization flaw exists. The root cause is incorrectly configured access control levels, enabling unauthorized actions due to insufficient restriction o...

EUVD-2026-53874

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...

CVE-2026-65551 WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...

CVE-2026-67303

A flaw was found in FreeRDP. When serial device redirection is active, a malicious server can send a crafted device control request. If this request specifies an unsupported operation with a non-zero output buffer, it can cause the FreeRDP client process to unexpectedly terminate. This leads to a...

MAL-2026-13403 Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

CVE-2026-64575

A flaw was found in the Linux kernel. A double release of socket resources can occur during batch reallocation in the BPF Berkeley Packet Filter TCP iterator. A local attacker could exploit this vulnerability to trigger a kernel panic. This leads to a system crash, resulting in a Denial of Servic...

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.2...

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin SureCart versions = 4.6.2...

CVE-2026-55979

An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies...

CVE-2026-55978

An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement...

SUSE-SU-2026:23152-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

EUVD-2026-53842

An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies...

CVE-2026-55979

CVE-2026-55979 affects CatchPulse via an improper access control check in CatchPulse’s named pipe communication interface. The flaw could let an attacker invoke CatchPulse functions, limited to operations that enforce more restrictive security policies. From the connected documents, the CVSSv3.1 ...

CVE-2026-55979 Improper access control check in CatchPulse's named pipe communication interface

An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies...

CVE-2026-55978 Improper access control vulnerability in CatchPulse

An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement...

EUVD-2026-53841

An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement...

CVE-2026-55978

CVE-2026-55978 describes an improper access control vulnerability in CatchPulse that could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse’s security policy enforcement. The NVD entry indicates a local attack vector wi...

CVE-2026-55978

An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement...