CVE-2025-66720

CVE-2025-66720 describes a null pointer dereference in free5gc pcf 1.4.0, in file internal/sbi/processor/ampolicy.go function HandleDeletePoliciesPolAssoId. Multiple sources (NVD, Red Hat, CIRCL, Snyk, CVE lists) corroborate the issue and its presence in free5gc/pcf 1.4.0. The advisory notes a cr...

MyBB_Plugin-Delete_Account security vulnerability

MyBBPlugin-DeleteAccount is a MyBB plugin developed by Vintagedaddyo. Version 1.4 of MyBBPlugin-DeleteAccount contains a security vulnerability. This vulnerability stems from the input field used for specifying the reason for account deletion, which has a cross-site scripting vulnerability,...

PT-2026-4470

Name of the Vulnerable Software and Affected Versions free5gc pcf version 1.4.0 Description A null pointer dereference exists in free5gc pcf version 1.4.0. This issue is located in the file internal/sbi/processor/ampolicy.go within the HandleDeletePoliciesPolAssoId function. Recommendations At th...

CVE-2026-1036

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletecomment function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to...

CVE-2026-24124

Dragonfly CVE-2026-24124 describes an unauthenticated access flaw in the Manager Job API. In versions 2.4.1-rc.0 and earlier, the Job API endpoints under /api/v1/jobs lack JWT authentication middleware and RBAC checks, allowing unauthenticated users with Manager API access to view, create, modify...

CVE-2026-0533

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local...

CVE-2026-0533

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local...

CVE-2026-0533 Stored XSS in Fusion desktop when attempting to delete a file

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local...

CVE-2026-0533

Technical details (affected product/version, root cause, exploit specifics, impact, or fixes) are not publicly available in the provided documents. Monitor for updates from Autodesk and security advisories to obtain concrete details and remediation guidance.

CVE-2026-0533 Stored XSS in Fusion desktop when attempting to delete a file

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local...

CVE-2026-0533

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local...

CVE-2026-1036

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletecomment function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to...

PT-2026-4292

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea does not correctly validate repository ownership during the deletion of Git LFS locks. This allows a user with write access to a repository to potentially delete LFS locks that belong to...

Dragonfly Manager Job API Unauthenticated Access

Dragonfly Manager's Job REST API endpoints lack authentication, allowing unauthenticated attackers to create, query, modify, and delete jobs, potentially leading to resource exhaustion, information disclosure, and service disruption...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37765)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37765 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix ttmbodelayeddele...

PT-2026-4201

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting XSS vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38278)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38278 advisory. - In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: QOS: Refactor...

WordPress plugin “Photo Gallery” by 10Web – Mobile-Friendly Image Gallery security vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Azure Linux 3.0 Security Update: kernel (CVE-2024-27012)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27012 advisory. - In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: restore set element...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38365)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38365 advisory. - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and...