CVE-2026-12697

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, enabling subscriber-level users to permanently delete another user’s AI chat history (IDOR). Root cause: missing ownership check on the delete a...

CVE-2026-12721

Summary: CVE-2026-12721 affects the Kirki WordPress plugin prior to 6.0.13. The vulnerability arises because the plugin does not properly sanitise and escape a value taken from the request before using it in a SQL statement, enabling unauthenticated SQL injection. Impact: High risk as it is unaut...

CVE-2026-16380 vulnerabilities

Vulnerabilities for packages: firefox...

SUSE CVE-2026-17722

Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-17752

Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17800

Inappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17817

Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17990

An insufficient validation of untrusted input flaw was found in the WebAuthn component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520018012...

ECHO-5503-28CB-5D02

Bulletin has no description...

UBUNTU-CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7...

Linux Distros Unpatched Vulnerability : CVE-2026-55707

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - neutron - None CVE-2026-55707 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, In...

UBUNTU-CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

PT-2026-66776

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.13 through 9.16 Description An issue exists where the AI Assistant's execute sql query tool fails to properly validate queries supplied by a Large Language Model LLM. The tool uses sqlparse to ensure only one...

UBUNTU-CVE-2026-53586

Unknown description...

UBUNTU-CVE-2026-63362

An unsigned integer underflow in the PubSub signature verification pat...

UBUNTU-CVE-2026-65423

An integer overflow in the UAVariant arrayDimensions product computa...

UBUNTU-CVE-2026-51291

sqlite 3.41 is vulnerable to use after free in the json.c jsonCacheIns...

CVE-2026-17722

An object lifecycle issue flaw was found in the WebView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523592755...

ECHO-2BB9-807E-6C70

Bulletin has no description...

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...