EUVD-2026-116729

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster...

CVE-2026-115257

The WP Roster WordPress plugin, versions prior to 2.36 , is vulnerable to an unauthenticated data modification flaw. The root cause is the lack of capability or nonce checks when writing stored roster data. This allows an unauthenticated attacker to overwrite, wipe, or restore the content of any ...

Bootloader_Unlock_Anbernic_T820

Anbernic Unisoc T820 Bootloader Unlock Guide - TheGammaSqueeze - https://github.com/TheGammaSqueeze The bootloader unlock is required before flashing any custom firmware or custom fixes. You may be interested in this analog stick sensitvity fix after unlocking your bootloader:...

CVE-2026-42569

🚨 CVE-2026-42569 - phpVMS Unauth Database Wipe Unauthenticated Database Wipe / Destructive Import in phpVMS 📌 Overview CVE-2026-42569 is a critical vulnerability in phpVMS Virtual Airline Management System that allows unauthenticated attackers to access legacy import endpoints. These endpoints we...

CVE-2026-115300

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

CVE-2026-115300

The Contact Form by Supsystic WordPress plugin, in versions before 1.11.1 , is vulnerable to Cross-Site Request Forgery (CSRF) . The application fails to validate CSRF tokens or request origins on two specific administrator-only actions: bulk-deleting captured form submissions and wiping form sta...

EUVD-2026-112609

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

Flexible GraphRAG: Cypher/Graph Injection Via Broken String-escaping In FalkorDB Adapter (_escape()) - Full Graph Wipe F

Description def escapev: str - str: return strv.replace"'", "'".replace"", "\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...

CVE-2026-115300: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two…

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

PT-2026-130652

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

GHSA-VQRG-773H-4WXC Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Description def escapev: str - str: return strv.replace"'", "\'".replace"\", "\\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Description def escapev: str - str: return strv.replace"'", "\'".replace"\", "\\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...

CVE-2026-114510 Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the escape helper in flexible-graphrag/langchain/graph/pgstoreadapters/falkordbadapter.py escapes quotes before...

CVE-2026-114510

The Flexible GraphRAG Python framework (versions 0.6.0 to 0.8.2) is vulnerable to Cypher/Graph Injection due to a broken string-escaping mechanism in the _escape() helper within the FalkorDB adapter . When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, an attacker can provide malic...

Astra Linux - Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Clear copies of clear-key structures on failure Clear all sensitive data from the stack for all IOCTLs that convert a clear-key into a protected- or secure-key...

EUVD-2026-95120

The Malcolm kiosk Flask application exposes a POST /scriptcall/ endpoint with zero authentication and wildcard CORS CORSapp. An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network...

CVE-2026-107337 Cross-Site Request Forgery in Malcolm

The Malcolm kiosk Flask application exposes a POST /scriptcall/ endpoint with zero authentication and wildcard CORS CORSapp. An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network...

CVE-2026-107337

The Malcolm kiosk Flask application is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to an unauthenticated POST /script_call/[removed] endpoint paired with a wildcard CORS(app) configuration. An attacker can trick an operator's browser into executing unauthorized management command...

CVE-2026-104059

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...