CVE-2026-56391 Out‑of‑bounds Read in GNU coreutils

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...

CVE-2026-12690

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...

EUVD-2026-48491

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...

CVE-2026-11354

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...

CVE-2026-54422

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

SUSE CVE-2026-21723

The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...

EUVD-2026-48466

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...

CVE-2026-11354

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...

CVE-2026-11354

The CVE-2026-11354 entry affects the WordPress plugin Participants Database (versions up to 2.7.8.3). The vulnerability is a Missing Authorization issue via the id parameter, allowing unauthenticated attackers to overwrite arbitrary participant records and redirect the private_id‑bearing record-a...

CVE-2026-11354 Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...

CVE-2026-13464 Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-48445

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

EUVD-2026-48449

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem...

CVE-2026-62825

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-48456

Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network...

PT-2026-64301

Name of the Vulnerable Software and Affected Versions Loytec LWEB-802 versions prior to 5.0.8 Description An issue exists where sensitive information is exposed within the browser localStorage. This allows an unauthenticated remote attacker to leak stored management credentials by using a crafted...

PT-2026-64428

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists where libsoup incorrectly attaches the Proxy-Authorization header to HTTPS requests sent through a CONNECT tunnel established via an HTTP proxy. This behavior allows the...

PT-2026-64227

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

PT-2026-64377

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated users possessing the PUBLICLINK CREATE profile flag can trigger unauthorized decryption and persistent storage of any vault account password. This occurs due to missing AccountAcl chec...

PT-2026-64313

Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...