CVE-2026-19899

CVE-2026-19899 affects SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is in an unknown function within the file /edit_teacher.php, where manipulating the argument ID can cause an SQL injection. It is described as exploitable remotely with a publicly disclosed exploit (PoC...

CVE-2026-12795

A flaw was found in BerriAI litellm. This vulnerability allows a remote attacker to bypass authentication within the SSO Debug Flow component by manipulating the json.dumps function. The successful exploitation of this flaw could lead to unauthorized access and potential information disclosure...

GHSA-3GMF-P6R4-Q8M6 vulnerabilities

Vulnerabilities for packages: geoserver...

CVE-2026-74377 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

EUVD-2026-59524

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

CVE-2026-74330

The CVE-2026-74330 entry specifies a Linux kernel fix for configfs lockless traversals of ->s_children. The issue allowed cursor movement or freeing under lock protection of the parent directory, potentially enabling invalid cursor states via lseek() despite entry protection from removal. The ...

CVE-2026-72164 ocfs2: avoid moving extents to occupied clusters

In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspace supplies a physical megoal. ocfs2moveextent initializes newphyscpos from that goal and expects ocfs2probeallocgroup to replace it...

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

EUVD-2026-58843

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128 Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128

CVE-2026-12128 affects Pinpoint Booking System – Version 2 for WordPress. The vulnerability allows unauthenticated attackers to manipulate checkout prices for any bookable product linked to a booking calendar by exploiting the WooCommerce price handling flow: the dopbsp_woocommerce_add_to_cart AJ...

CVE-2026-12128

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-12128 Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-8840

The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...

CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

EUVD-2026-58839

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-49844 vulnerabilities

Vulnerabilities for packages: spark, zipkin, spdx-tools-java, neo4j, apache-activemq-artemis, apache-tika, keycloak-config-cli, celeborn, trino, apache-pulsar, kserve-modelmesh, kafka, thingsboard, solr, wavefront-proxy, strimzi-kafka-operator, opensearch, druid, akhq, flink, wildfly, infinispan,...

CVE-2026-12128: Improper Input Validation

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...