OPENSUSE-SU-2026:21540-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

SUSE-SU-2026:23003-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

SUSE-SU-2026:23129-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

SUSE-SU-2026:23152-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

WordPress WPMU DEV Dashboard plugin <= 5.0.0 - Authentication Bypass to Arbitrary plugin Installation (Remote Code Execution) vulnerability

Authentication Bypass to Arbitrary plugin Installation Remote Code Execution vulnerability discovered by Austin Ginder in WordPress Plugin WPMU DEV Dashboard versions = 5.0.0...

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild

A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency CISA. The vulnerability in question is CVE-2026-63077 CVSS score: 9.8, a case of deserialization...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15991

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15459

The CVE-2026-15459 entry concerns the WordPress WPMU DEV Dashboard plugin (≤ 5.0.0). Public details show an authentication bypass allowing unauthenticated attackers to perform privileged Hub actions, including installing/activating plugins from attacker URLs (remote code execution), deleting plug...

CVE-2026-15459 WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

EUVD-2026-53710

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

EUVD-2026-53703

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

SUSE CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

cve-2026-poc-collection

CVE-2026 Proof-of-Concept PoC Collection Report Collectio...

CVE-2026-67531

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2024-39024

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

EulerOS 2.0 SP15 : python-ply (EulerOS-SA-2026-2945)

According to the versions of the python-ply packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in th...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-3048)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

Linux Distros Unpatched Vulnerability : CVE-2026-45538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255...