CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

Scrapling v0.4.13

Effortless Web Scraping for the Modern Web العربيه | Español | Português Brasil | Français | Deutsch | 简体中文 | 日本語 | Русский | 한국어 Selection methods · Fetchers · Spiders · Proxy Rotation · CLI · MCP Scrapling is an adaptive Web Scraping framework that handles everything f...

CLSA-2026-1786342480 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 3 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.4...

CVE-2026-17018

The CubeWP Framework WordPress plugin (versions through 1.1.30 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw due to a lack of per-object read authorization checks and missing restrictions on metadata keys. This allows users with the Contributor role or higher to access arbitr...

EUVD-2026-55025

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CLSA-2026-1786339580 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.5...

PT-2026-69359

Name of the Vulnerable Software and Affected Versions CubeWP Framework WordPress plugin versions prior to 1.1.31 Description An issue exists where a REST API endpoint fails to perform per-object read authorization checks and does not restrict the metadata keys that can be requested. This allows...

CVE-2026-68211: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffe...

PT-2026-69611

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the stm32-dcmipp media component where queued buffers leak if the dcmipp bytecap start streaming function returns an error without returning those buffers via vb2 buff...

CVE-2026-72578: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-17018: Authorization Bypass Through User-Controlled Key

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

PT-2026-69462

Name of the Vulnerable Software and Affected Versions FreePBX Framework version 17.0 Description A cross-site request forgery CSRF issue allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The '/admin/ajax.php' endpoint in amp...

Linux Distros Unpatched Vulnerability : CVE-2026-68211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. I...

Sneeit Framework Code Execution

The vulnerability of the sneeitarticlespaginationcallback function in the Sneeit Framework, a content management system for WordPress, is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2026-69680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cdns-dsi bridge where the use of the deprecated UNIVERSAL DEV PM OPS macro causes DSI clocks to be disabled twice: once during runtime suspend and again during...

CVE-2026-68222: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers vi...

Linux Distros Unpatched Vulnerability : CVE-2026-68216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If...