PT-2026-64998

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

CVE-2026-51300

A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to release an expression object, the program still retains the dangling pointer and subsequently accesses member fields of the already freed memory. By...

About the security content of visionOS 26.6

About the security content of visionOS 26.6 This document describes the security content of visionOS 26.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

PT-2026-65305

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the DeleteNotificationController::delete method at the GET /notification/delete/id endpoint. This flaw allows any authenticated us...

CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-66373

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK pending entry is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free...

Improper Neutralization of Special Elements in Data Query Logic

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify or delete arbitrary documents, an...

CVE-2026-48035 Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while...

CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-8789

The Easy Appointments WordPress plugin is vulnerable to unauthorized data modification via the ea_delete_multiple_connections AJAX action, due to a missing capability check and missing nonce verification in all versions up to 3.12.27. Authenticated attackers with Contributor-level access and abov...

OESA-2026-3154 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up th...

CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

EUVD-2026-48464

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

CVE-2026-15420

The CVE-2026-15420 entry concerns Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder for WordPress. Affected component: the WordPress plugin itself (Nexter Blocks) with a Directory Traversal flaw exploitable via the plus_name parameter. Impact: authenticated attackers with subscr...

SUSE CVE-2026-63858

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

PT-2026-64321

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the ea delete multiple connections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...

PT-2026-64376

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description A missing object-level authorization issue exists in the JSON-RPC API. This allows holders of API tokens to enumerate account metadata, overwrite passwords, and delete accounts across the entire...