CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14222

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Connection Deletion vulnerability

Contributor+ Connection Deletion vulnerability discovered by WEI HSIANG WANG in WordPress Plugin Easy Appointments versions = 3.12.26...

CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

CVE-2026-64392

A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to bypass filesystem permission checks during 'delete-on-close' operations. Specifically, when a file handle is torn down, the base-file unlink and extended attribute xattr removal operations...

PT-2026-66381

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

EUVD-2026-50417

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560 posix-cpu-timers: Prevent UAF caused by non-leader exec() race

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

CVE-2026-64560

CVE-2026-64560 documents a Linux kernel issue in posix-cpu-timers that can cause a Use-After-Free when a timer is deleted during a non-leader exec() race. The vulnerability arises as sys_timer_delete() may observe an old leader while a leader change occurs, leading to a freed posix timer object b...

CVE-2026-65889

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

CVE-2026-65889

Joomla extension Gridbox (balbooa.com) for

CVE-2026-65889

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

EUVD-2026-50334

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...