PT-2026-69808

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the cfg80211 module when a netlink socket owning a PMSR session is closed. The function cfg80211 release pmsr queues pmsr free wk to call cfg80211 pmsr process abort...

PT-2026-69344

Name of the Vulnerable Software and Affected Versions Autopay WordPress plugin versions prior to 5.0.1 Description An issue exists where the software fails to perform capability or nonce checks before saving a styling option from a public request. Additionally, the saved value is not escaped when...

Linux Distros Unpatched Vulnerability : CVE-2026-68130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate,...

Linux Distros Unpatched Vulnerability : CVE-2026-68408

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: convert pmsrfreewk to wiphywork to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211releasepmsr clears the...

CVE-2026-19370 bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires...

CVE-2026-19370

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

EUVD-2026-54882

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The InfiniteWP Client WordPress plugin (versions

CVE-2026-19327

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

CVE-2026-19327

CVE-2026-19327 affects the package abracadabra50 claude-sesh 1.0.0. The flaw is in the function getEnrichedData/enrichSession within src/services/enricher.ts, where manipulating the argument sessionId can trigger path traversal. The issue is operable locally, with CVSS-based assessments indicatin...

CVE-2026-19327 abracadabra50 claude-sesh enricher.ts enrichSession path traversal

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

CVE-2026-19327

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

PT-2026-130619

Уязвимость метода createKeyBundle приложения для удаленного доступа по сети X2Go связана с ошибками при управлении привилегиями. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, открыть полноценный SSH-сеанс...

Linux Distros Unpatched Vulnerability : CVE-2026-19016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted...

SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:3526-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3526-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598:...

LDAP BIND Session

BIND payload for listeners/database/ldap !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "LDAP BIND Session", "description": "BIND payload for listeners/database/ldap", "category":...

MSSQL BIND Session

BIND payload for listeners/database/mssql !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "MSSQL BIND Session", "description": "BIND payload for listeners/database/mssql", "category":...

SMB Client BIND Session

BIND payload for listeners/smb/client !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "SMB Client BIND Session", "description": "BIND payload for listeners/smb/client", "category":...