PT-2026-116948

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply va align to hugetlb mappings on AMD F15h get align mask returns huge page mask align for hugetlbfs, but get align bits adds va align.bits regardless, so vm unmapped area returns an address off the huge page...

WordPress Electronic Signature Add-on for Fluent Forms Authorization Issue Vulnerability

The WordPress Electronic Signature Add-on for Fluent Forms 2.0.5 and earlier versions has an authorization issue vulnerability. This vulnerability stems from bypassing authorization through the user-controlled key, which may lead to security breaches if the access control levels are improperly...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.15 contains security vulnerabilities. These vulnerabilities stem from the Wake-on-LAN branch of the bcmgenetnetifstop and bcmgenetsuspend functions, which first disable the Tx queue and then stop the Tx NAPI. As a result, sending operations can reach the circular buffer...

BMC Helix Network Management Authentication Bypass

BMC Helix Network Management versions before 26.3.01 contain an authentication bypass when SAML-based single sign-on is configured, allowing the local administrator account to authenticate with any password...

CVE-2026-77524 vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent-fips, kserve-fips, kserve, keda-http-add-on, kserve-localmodelnode-agent, k8sgpt, keda-http-add-on-fips...

GHSA-637C-6JXX-4RWM vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent-fips, kserve-fips, kserve, keda-http-add-on, kserve-localmodelnode-agent, k8sgpt, keda-http-add-on-fips...

Exploit for CVE-2026-61979

🚀 CVE-2026-61979 - miniOrange SAML Single Sign On Authenticati...

CVE-2026-102551

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

CVE-2026-110806

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data...

CVE-2026-110806

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data...

CVE-2026-110806

The Devolutions Server versions 2026.3.8.0 and earlier are affected by an incorrect authorization vulnerability in the add-on properties. This flaw allows an authenticated user with only View permission to obtain add-on passwords by accessing unredacted add-on properties returned in connection da...

CVE-2026-110806

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data...

WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Oly Hossen in WordPress Plugin Electronic Signature Add-on for Fluent Forms versions = 2.0.5...

EUVD-2026-102687

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on...

EUVD-2026-102474

BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrar...

CVE-2026-110806: Incorrect Authorization

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data...

PT-2026-115609

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.8.1 Description Incorrect authorization in add-on properties allows an authenticated user with only View permission to obtain add-on passwords. This occurs because unredacted add-on properties are...

PT-2026-115467

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks on sites that use the WCFM Delivery add-on. This occurs because the plugin fails to sanitize and escape a parameter...

PT-2026-115453

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the role parameter handled by the wppb add meta to user on activation function. The vulnerabili...

CVE-2026-111283

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...