DEBIAN-CVE-2026-78807

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

AZL-103386 CVE-2026-78807 affecting package wpa_supplicant 2.10-3

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

CVE-2026-78807

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

UBUNTU-CVE-2026-78807

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

CVE-2026-71416

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to...

CVE-2024-12145

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-12145 BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2024-55759

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-12145

The BuddyPress WordPress plugin (versions ≤ 14.3.3 ) is vulnerable to an Insecure Direct Object Reference in the bp_notifications_action_bulk_manage function, caused by missing validation on a user-controlled key. Authenticated attackers with Subscriber-level access or higher can delete or change...

CVE-2026-8778

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

CVE-2026-8778

The MIPL Grouped Checkout Fields for WooCommerce WordPress plugin is vulnerable to an unauthenticated arbitrary file upload caused by missing file type validation in the mipl_wc_upload_file function. The flaw affects all versions up to and including 1.2.2 (noted as 1.2.1 in the CVE record), allow...

CVE-2026-78807

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

PT-2026-89869

Name of the Vulnerable Software and Affected Versions Headroom versions prior to 0.35.0 Description The Headroom WebSocket server fails to validate the Origin header of incoming client WebSocket requests before forwarding them to the upstream server. This allows malicious WebSocket clients, which...

PT-2026-90432

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the zram module where user-supplied deflate parameters are not properly validated. Specifically, the winbits variable is passed to the zlib deflate workspacesize...

PT-2026-90327

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS driver where the ntfs attr update meta function fails to properly validate the name offset when converting between non-sparse and sparse attributes. Convertin...

PT-2026-90494

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.2 Description The Area API's 'block-create' endpoint fails to invoke the validate method of the block type controller for submitted data. For blocks that reference files, such as hero image and gallery,...

PT-2026-90417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfsd component where the xdrgen-based TIME DELEG ACCESS and TIME DELEG MODIFY decode arms store a raw uint32 t nseconds directly into tv nsec without verifying tha...

EUVD-2026-76184

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

CVE-2026-78807

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching. This vulnerability is caused by missing validation in the driver-based PMKSA selection path located in wpa.c . No specific exploitation details or re...

PT-2026-89863

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp notifications action bulk manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...