CVE-2026-92713: Missing Authorization

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

EXOS < 31.7.4 / 32.0.0 < 32.7.4.15 / 33.0.0 < 33.1.100, 33.7.0 < 33.7.1 Privilege Escalation (SA-2026-087)

The version of EXOS installed on the remote host is missing a security update. It is, therefore, affected by an privilege escalation vulnerability. - ExtremeXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value can be predicted unde...

PT-2026-99091

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software lacks object-level authorization in user management endpoints, which allows sub-administrators to modify or delete users without ownership verification. Attackers possessing...

The vulnerability of the libssh library, related to the lack of measures taken to clean data at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the libssh library is related to the lack of measures taken to clean data at the administrative level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...

PT-2026-98392

Name of the Vulnerable Software and Affected Versions Modula Image Gallery – Photo Grid & Video Gallery versions prior to 3.0.3 Description Insufficient file path validation in the upload image function allows authenticated attackers with author-level access or higher to delete arbitrary files on...

PT-2026-98380

Name of the Vulnerable Software and Affected Versions Asset CleanUp: Page Speed Booster versions prior to 1.4.0.6 Description Server-Side Request Forgery occurs via the page url parameter. Authenticated attackers with administrator-level access or higher can initiate web requests to arbitrary...

PT-2026-98533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the iova to phys function when using a 5-level translation table via ZPCI TABLE TYPE RFX. This happens because the get rto from iova function fails t...

Exploit for CVE-2026-72001

CVE-2026-72001 — Pangolin Cross-Organization Resource Authenti...

AZL-105113 CVE-2026-96747 affecting package python-pymongo 4.2.0-9

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

DEBIAN-CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

UBUNTU-CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

CVE-2026-96747

A flaw was found in pymongo. When client-side field-level encryption is configured, the driver misinterprets Key Management Service KMS endpoint addresses ending in '.sock' as local Unix domain socket files rather than remote network hosts. An authenticated database user with permission to modify...

CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

CVE-2026-96747

The MongoDB Python Driver client-side field level encryption support contains a vulnerability where a key management endpoint ending in .sock is incorrectly treated as a local Unix domain socket path instead of a remote host. An attacker with write access to encryption key metadata in the databas...

WordPress OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin Desktop Mode versions = 1.1.7...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.1.0 Vulnerability Details CVEID:CVE-2026-12537 DESCRIPTION: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.2...

CVE-2026-17511

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service...

CVE-2026-17511 This Power System update is being released to address

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service...