CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 expose an Insecure Direct Object Reference (IDOR) in the /v1.3.0/api/files endpoint. An authenticated attacker can modify the remark parameter to enumerate, access, and delete files owned by other users, impacting confidentiality, integrity, and availability. Root...

CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive...

CVE-2026-58484 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive...

CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist 'css','js','html','txt','json','sql','md' on content-write operations saveFile, createFile, but two destructive endpoints — deleteFileOrFolder and...

Path Traversal

Snipe-IT is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of asset image paths during CSV import and image deletion, where attacker-controlled path traversal sequences can reference arbitrary files, allowing authenticated users to delete files accessible to the...

WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin Picture Gallery versions = 1.6.5...

CVE-2026-13156

The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action it verifies the manageoptions capability but ignores the nonce, so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin...

CVE-2026-13156

The CVE concerns the MailerSend WordPress plugin (before version 1.0.8). The root cause is lack of nonce validation on the configuration-delete action, while a capability check (manage_options) is performed. This CSRF-like flaw enables a logged-in administrator to be tricked into visiting a craft...

CVE-2026-13156 MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action it verifies the manageoptions capability but ignores the nonce, so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin...

Linux Distros Unpatched Vulnerability : CVE-2026-64119

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU...

Linux Distros Unpatched Vulnerability : CVE-2026-64043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ovpn: fix race between deleting interface and adding new peer While deleting an existing ovp...

Linux Distros Unpatched Vulnerability : CVE-2026-53389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/tcp-ao: fix use-after-free of key in delasync path In tcpaodeletekey, the delasync path skips the currentkey and rnextkey validity checks present in the...

CVE-2026-64178

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection needs to keep holding the bnepsessionsem while reading dev-name just like bnepgetconnlist does; otherwise the bnepsession thread can concurrently free the netdevice, whi...

CVE-2026-64123

CVE-2026-64123 concerns the Linux kernel HSR subsystem. The vulnerability arises when HSR node-list/node-status operations run under rcu_read_lock() and RTM_DELLINK teardown frees the same node table immediately via list_del(), allowing a generic-netlink reader to hold a pointer to a freed hsr_no...

CVE-2026-64119 l2tp: use list_del_rcu in l2tp_session_unhash

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

EUVD-2026-45804

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

CVE-2026-64043

The CVE-2026-64043 entry describes a race condition in the Linux kernel related to ovpn interfaces. During deletion of an ovpn netdevice, a CMD_PEER_NEW netlink message could race with the unregistration process, taking a fresh reference to the netdev and leaving the device in a state where it ca...

AZL-92582 CVE-2026-63858 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

CVE-2026-63969

The CVE-2026-63969 entry describes a Linux kernel issue where a potential infinite loop in rt6_fill_node() can occur due to unsafe manipulation of fib6_siblings while holding tb6_lock. The root cause is that rt-&gt;fib6_siblings.next can point into the old ring if a walker runs concurrently with ...

CVE-2026-63969 ipv6: fix possible infinite loop in rt6_fill_node()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...