CVE-2026-15303

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128 Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-15303 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-15303

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

CVE-2026-15303

The CVE pertains to the 6Storage Rentals WordPress plugin (affected versions up to 2.27.0). The vulnerability is an authentication bypass in the six_storage_create_wp_user() AJAX handler, registered on wp_ajax_nopriv_six_storage_create_wp_user without nonce, capability, credential, or ownership v...

EUVD-2026-58840

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

PT-2026-72861

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist...

PT-2026-72329

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read of 0 IRQ SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects it as -EPROTO. Worse, it returns without a NACK+STOP: the next...

PT-2026-72849

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci get drvdata type in AER handlers rtw89 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...

PT-2026-72848

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci get drvdata type in AER handlers rtw88 stores an ieee80211 hw pointer via pci set drvdata at probe time, but io error detected and io resume retrieve it as a net device pointer. This causes netif device...

PT-2026-72876

Name of the Vulnerable Software and Affected Versions Wholesale Market versions prior to 2.2.3 Description The Wholesale Market plugin for WordPress allows authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator. This occurs when the site...

PT-2026-72150

Name of the Vulnerable Software and Affected Versions Cookie Banner for GDPR / CCPA – WPLP Cookie Consent versions prior to 4.3.6 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrar...

PT-2026-72670

In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptor busy in command ioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptor busy reference counter to pin struct gpib descriptor across IO ioctl...

PT-2026-72334

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-ch base, which is initialized only aft...

PT-2026-72745

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeon ep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in oct hw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the...

Linux Distros Unpatched Vulnerability : CVE-2026-72384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using...

PT-2026-72572

In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irq set chained handler and data, but the remove function does not clear this handler...

PT-2026-72612

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313 rtc probe calls devm request irq with IRQF SHARED and &pdev-dev as the cookie, but platform set drvdata is only called later after the clock setup. With a shared I...

PT-2026-72144

Name of the Vulnerable Software and Affected Versions 6Storage Rentals versions prior to 2.27.1 Description An authentication bypass exists that allows unauthenticated attackers to log in as any existing WordPress user, including administrators. The issue occurs because the six storage create wp...