CVE-2026-5093: Missing Authorization

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-74724: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...

CVE-2026-53527

LeafWiki (a self-hosted wiki) versions 0.1.0 through 0.10.0 contain a privilege escalation vulnerability in the user update API. An authenticated user can modify their own account role, escalating from a regular role (e.g., viewer) to admin . The attack requires a valid authenticated account, mea...

EUVD-2026-63988

A vulnerability in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without...

CVE-2026-68554

A flaw was found in Coturn, a free open source implementation of TURN and STUN Session Traversal Utilities for NAT Server. An on-path attacker can exploit this vulnerability on plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY field in an authenticated STUN request. This allows...

WordPress KiviCare plugin < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR vulnerability

Patient+ Cross-Patient Appointment Modification via IDOR vulnerability discovered by Erwan LR WPScan in WordPress Plugin KiviCare versions 4.5.4...

BIT-GITLAB-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

WordPress Eventin plugin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR vulnerability

Contributor+ Schedule Deletion and Modification via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress Eventin plugin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation vulnerability

Contributor+ User Role and Meta Modification via Speaker Creation vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.21...

openSUSE 16: kubevirt1.8-container-disk / kubevirt1.8-libguestfs-tools / etc (openSUSE-SU-2026:21590-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21590-1 advisory. Update to version 1.8.4. Security issues fixed: - CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via...

PT-2026-79913

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:3652-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3652-1 advisory. - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership...

CVE-2026-53569

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

GHSA-3277-H8G9-QJ5F Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

CVE-2026-19683

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways . During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel . An attacker with visibility or control of the relevant network path can obtain ...

CVE-2026-53569 Frappe: Missing authorization in toggle_like and mark_as_seen

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

CVE-2026-63042

Apache InLong (versions 2.0.0 through 2.3.x) is vulnerable to a flaw where any authenticated manager user can create, modify, or delete Data Node definitions . This missing authorization on management endpoints can lead to files or directories becoming accessible to external parties. To remediate...

CVE-2025-62300

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

CVE-2025-62300

HCL IntelliOps Event Management (IEM) has a race condition creating a timing window where an unauthenticated, network-adjacent attacker can modify a resource, causing unpredictable behavior with high integrity impact (CVSS 5.9). No patch version or exploit details are provided; monitor HCL PSIRT ...