CVE-2026-81472

Dell iDRAC Service Module iSM for Windows, Dell iDRAC Service Module iSM for Linux, and Dell iDRAC Service Module iSM for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code 'Code Injection' vulnerability. A high privileged attacker with local access could...

CVE-2026-81472

Dell iDRAC Service Module iSM for Windows, Dell iDRAC Service Module iSM for Linux, and Dell iDRAC Service Module iSM for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code 'Code Injection' vulnerability. A high privileged attacker with local access could...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

WordPress Postie plugin <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Postie versions = 1.9.87...

WordPress The Innovative Form Builder – IvyForms plugin <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload vulnerability

Authenticated Custom+ Arbitrary File Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin IvyForms versions = 1.5.1...

WordPress Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter vulnerability

Authenticated Shop Manager+ Privilege Escalation to 'page' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin WpEvently versions = 5.7.8...

WordPress Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin <= 17.214.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Knowledge Base for Documentation, FAQs with AI Assistance versions = 17.214.0...

Wazuh and AI for Enhanced SOC Workflows

Artificial Intelligence AI has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making...

EUVD-2026-112024

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

WordPress MxChat – AI Chatbot & Content Generation for WordPress plugin <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin MxChat versions = 3.2.25...

EUVD-2026-112023

Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3...

CVE-2026-116855 WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3...

CVE-2026-116855 WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3...

CVE-2026-99215

In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as externalpowerchanged triggered by the TCPM...

CVE-2026-99216

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbusconnection.connstate to DISCONNECTED prior to calling vmbusdisconnect. But vmbusdisconnect calls vmbusinitiateunload, whi...

CVE-2026-99208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

CVE-2026-99211

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99210

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

CVE-2026-99207

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...