CVE-2026-14602

The CVE describes unauthenticated deserialization in the Remote API WordPress plugin (versions up to 0.2). An attacker can inject arbitrary PHP objects via a query parameter, potentially triggering remote code execution if a suitable gadget chain exists through another installed Remote API WordPr...

CVE-2026-14226

CVE-2026-14226 concerns the Easy Appointments WordPress plugin (up to version 3.12.26). The issue is an insufficient capability check on one of the plugin’s appointment-listing REST endpoints, which currently restricts access to a capability that every authenticated user has. As a result, users w...

Exploit for Heap-based Buffer Overflow in Libarchive

CVE-2025-5915 — libarchive RAR v4 heap over-read with on-devi...

CVE-2026-14221 Easy Appointments <= 3.12.26 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

CVE-2026-14221

Affected product: Easy Appointments WordPress plugin (≤ 3.12.26). Vulnerability: Missing authorization checks in several appointment-management actions; relies on a nonce that is obtainable by any authenticated user. Root cause: Lack of capability checks allows bypassing access controls. Impact: ...

CVE-2026-17778

A flaw was found in Google Chrome. This use-after-free vulnerability in the Extensions component allows a remote attacker to execute arbitrary code within a sandbox. This can be exploited by convincing a user to install a specially crafted Chrome Extension...

Exploit for CVE-2026-49865

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypas...

CVE-2026-64426

A flaw was found in the Linux kernel's iouring/nop component. A local user could exploit this by submitting a specially crafted no-operation NOP request. This could lead to a file reference not being properly released, resulting in a memory leak. Over time, this memory leak could impact system...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327

CVE-2026-59327 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue is that the Spring Boot DevTools remote secret (spring.devtools.remote.secret) is stored as a plain string attribute on the "Spring Boot DevTools Client" launch configuration and persisted as cleartext XML, either in w...

gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a...

gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb

A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...

CVE-2026-64455

A flaw was found in the Linux kernel's chaoskey driver. A local user could trigger a use-after-free vulnerability by closing the device file after the associated USB device has been unplugged. This could lead to a system crash due to memory corruption when a debugging statement attempts to access...

CVE-2026-67247

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...

CVE-2026-67248

A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial ...

CVE-2026-67246

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside...

CVE-2026-67245

A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated attacker can exploit this issue to write an...

CVE-2026-1360

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-14356

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-16524 Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...