CVE-2026-21058

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

CVE-2026-21058

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

EUVD-2026-55083

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-17540

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

CVE-2026-19077

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-19077

The Duplicate Post WordPress plugin (versions before 1.5.5 ) is vulnerable to an authenticated arbitrary post deletion flaw. The root cause is a lack of per-object authorization checks during the plugin's bulk copy and delete operations. This allows any user granted access to the plugin by an adm...

EUVD-2026-55000

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

EUVD-2026-55010

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

CVE-2026-18934 RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-17540

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

EUVD-2026-55041

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

PT-2026-69382

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.5 Description Insufficient per-object authorization checks in bulk copy and delete operations allow users with assigned plugin access to permanently delete arbitrary posts on the site,...

CVE-2026-19077: Authorization Bypass Through User-Controlled Key

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...

CVE-2026-17540: Improper Access Control

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

PT-2026-69914

Name of the Vulnerable Software and Affected Versions Vault Enterprise versions prior to 2.0.4 Vault Enterprise versions prior to 1.21.9 Vault Enterprise versions prior to 1.20.14 Vault Enterprise versions prior to 1.19.20 Description The identity entity batch-delete endpoint is subject to a...

CVE-2026-14886: Missing Authorization

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability CVE-2026-14886 is fixed...

CVE-2026-18934: Incorrect Authorization

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

CVE-2026-72734: Authorization Bypass Through User-Controlled Key

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer...

CVE-2026-72569: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...