CVE-2026-17018

The CubeWP Framework WordPress plugin (versions through 1.1.30 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw due to a lack of per-object read authorization checks and missing restrictions on metadata keys. This allows users with the Contributor role or higher to access arbitr...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

EUVD-2026-55025

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CLSA-2026-1786339580 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.5...

CVE-2026-72578: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-17018: Authorization Bypass Through User-Controlled Key

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-68211: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffe...

CVE-2026-68280: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

CVE-2026-68222: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers vi...

CVE-2026-68216: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

PT-2026-69680

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cdns-dsi bridge where the use of the deprecated UNIVERSAL DEV PM OPS macro causes DSI clocks to be disabled twice: once during runtime suspend and again during...

The vulnerability of the sneeit_articles_pagination_callback() function in the Sneeit Framework, a content management system for WordPress, allows a hacker to execute arbitrary code.

The vulnerability of the sneeitarticlespaginationcallback function in the Sneeit Framework, a content management system for WordPress, is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-68280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system...

PT-2026-69462

Name of the Vulnerable Software and Affected Versions FreePBX Framework version 17.0 Description A cross-site request forgery CSRF issue allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The '/admin/ajax.php' endpoint in amp...

Linux Distros Unpatched Vulnerability : CVE-2026-68211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: stm32-dcmipp: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. I...

Linux Distros Unpatched Vulnerability : CVE-2026-68216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If...

CVE-2026-68213: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

The vulnerability of the HttpObjectDecoder decoder, a framework for developing network applications, servers, and clients using the Netty protocol, allows a attacker to cause a service failure.

The vulnerability of the HttpObjectDecoder decoder, a framework for developing network applications, servers, and clients using the Netty protocol, is related to deficiencies in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

CVE-2026-68209: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...