CVE-2026-17018: Authorization Bypass Through User-Controlled Key

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

PT-2026-69680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cdns-dsi bridge where the use of the deprecated UNIVERSAL DEV PM OPS macro causes DSI clocks to be disabled twice: once during runtime suspend and again during...

CVE-2026-68222: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers vi...

CVE-2026-68213: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

CVE-2026-68216: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

PT-2026-69611

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the stm32-dcmipp media component where queued buffers leak if the dcmipp bytecap start streaming function returns an error without returning those buffers via vb2 buff...

CVE-2026-68280: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

CVE-2026-68209: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

PT-2026-69462

Name of the Vulnerable Software and Affected Versions FreePBX Framework version 17.0 Description A cross-site request forgery CSRF issue allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The '/admin/ajax.php' endpoint in amp...

CVE-2026-72578: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-68211: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffe...

Linux Distros Unpatched Vulnerability : CVE-2026-68211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. I...

Linux Distros Unpatched Vulnerability : CVE-2026-68231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If...

Linux Distros Unpatched Vulnerability : CVE-2026-68280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system...

Linux Distros Unpatched Vulnerability : CVE-2026-68216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If...

Linux Distros Unpatched Vulnerability : CVE-2026-68213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: rtl2832sdr: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If...

Sneeit Framework Code Execution

The vulnerability of the sneeitarticlespaginationcallback function in the Sneeit Framework, a content management system for WordPress, is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

HttpObjectDecoder Decoder DoS

The vulnerability of the HttpObjectDecoder decoder, a framework for developing network applications, servers, and clients using the Netty protocol, is related to deficiencies in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

EEF-CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Summary Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongs...