CVE-2026-11496

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

CVE-2026-19991

CVE-2026-19991 affects the UsersWP WordPress plugin in versions up to and including 1.2.70 , allowing authenticated attackers with Subscriber-level access or higher to perform arbitrary file deletion via the upload_file_remove() AJAX handler. The root cause lies in a validation bypass: the plugin...

CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

EUVD-2026-75939

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

EUVD-2026-75929

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

PT-2026-90592

Name of the Vulnerable Software and Affected Versions DT LMS – elearning versions prior to 1.2 Description The DT LMS – elearning WordPress plugin allows unauthenticated attackers to modify arbitrary plugin option values in the wp options table. This is caused by a missing capability check and la...

PT-2026-90185

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the lp8727 release irq function. The threaded IRQ handler lp8727 isr func arms pchg-work using schedule delayed work. Because lp8727 release irq cancels...

PT-2026-90224

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/ucma component where the ucma set ib path function calls ucma event handler during a write path without acquiring the necessary handler lock. This failure to...

CVE-2026-80950: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

PT-2026-90135

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the IPMI system interface si during a failed registration process. When try smi init fails to obtain the BMC device information via bmc get device id...

BGP OPEN Message Handler DecodeFromBytes() Privilege Escalation

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the BGP OPEN Message Handler component is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

PT-2026-96384

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727 release irq lp8727 isr func, the threaded IRQ handler, is the only caller that arms pchg-work via schedule delayed work. lp8727 release irq currently cancels the work before...

CVE-2026-89469: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

CVE-2026-90453: URL Redirection to Untrusted Site

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-89260: Improper Restriction of XML External Entity Reference

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

PT-2026-89754

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload file remove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $ POST when no real $ FILES upload is provided process accoun...

BGP Header Handler DecodeFromBytes Privilege Escalation

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the BGP Header Handler component of the GoBGP border gateway protocol is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

PT-2026-90080

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Renesas I3C driver employs an asynchronous model for data transfer by preparing a renesas i3c xfer structure, enqueuing it, and waiting for completion. A race condition occurs when a...

PT-2026-96429

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr rdy work, max charging time work and batt presence work. pwr rdy work and batt presence work can also queue max charging time work...