CVE-2026-74928

The Project Manager WordPress plugin (versions 2.1.0-4.0.6 ) contains an authentication bypass vulnerability due to a lack of authorization checks on its import routes , specifically identified in the context of Trello import routes . This flaw allows unauthenticated users to create WordPress acc...

CVE-2026-19220

The Forminator Forms WordPress plugin in versions prior to 1.57.1 is vulnerable to unauthenticated multisite site creation and privilege escalation. The root cause is a failure to verify if site registration is enabled on the network before processing a site signup. This allows unauthenticated vi...

CVE-2026-19220 Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

EUVD-2026-66274

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-19220 Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

EUVD-2026-66270

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...

CVE-2026-80193

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

SUSE CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the QuickEntry process. An attacker can gain unauthorized access to create timesheet records for other team members by submitting the QuickEntry form without proper permission validation. Remediation Upgrade...

PT-2026-82147

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the xfs component. This occurs within the xrep tempfile create function if the tempfile creation process fails after the sc-tempip variable has been...

CVE-2026-74928: Missing Authorization

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

PT-2026-81958

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

PT-2026-82350

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 2.0.0 Description A local attacker on a multi-user host can perform cache poisoning by pre-creating a deterministic cache path and planting a malicious ONNX Open Neural Network Exchange model file. ONNX is an...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098813)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098813 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix & Optimize table creation from possibly unaligned memory Source blob may come from...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gdm (UTSA-2026-093028)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093028 advisory. gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098682)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098682 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvmarchvcpucreate fails to share the vCPU...

CVE-2026-80193

Kimai before 2.62.0 is affected by an authorization bypass in the QuickEntry controller . The root cause is a missing validation of the create_other_timesheet permission when creating new timesheets. Authenticated users who hold only view_other_timesheet and edit_other_timesheet permissions can c...

CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...