EUVD-2026-78641

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct H...

@frontmcp/adapters (>=1.0.4, <=1.5.0-rc.1), @frontmcp/plugin-skilled-openapi (>=0.0.1, <=1.5.0-rc.1) potentially affected by CVE-2026-59973 via mcp-from-openapi (>=2.3.0, <=2.4.0)

mcp-from-openapi NPM version =2.3.0, =1.0.4, =0.0.1, =1.5.0-rc.1 Source cves: CVE-2026-59973 Source advisory: MEND:CVE-2026-59973...

@frontmcp/plugin-skilled-openapi (>=0.0.1, <=1.5.0-rc.1) potentially affected by CVE-2026-59973 via @frontmcp/adapters (>=1.0.4, <=1.5.0-rc.1)

@frontmcp/adapters NPM version =1.0.4, =0.0.1, =1.5.0-rc.1 Source cves: CVE-2026-59973 Source advisory: MEND:CVE-2026-59973...

grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...

rabbitmq-server: rabbitmq-server: Denial of Service via resource exhaustion in authentication mechanism handling

A flaw was found in rabbitmq-server. An authenticated remote attacker with policymaker privileges can exploit this issue when the Shovel or Federation plugin is enabled by supplying a specially crafted authentication mechanism value. This causes the server to permanently exhaust Erlang virtual...

rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass

A flaw was found in RabbitMQ. An authorization bypass vulnerability allows a management-tagged user to read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible virtual hosts vhosts. This exposes sensitive cross-tenant queue names and cluster topology...

rabbitmq-server: RabbitMQ: Monitoring user can reset authentication attempt counters

A flaw was found in RabbitMQ. A user with a monitoring tag, when the Management plugin is enabled, can reset the per-node authentication-attempt counters. This action, which should be restricted to administrators, allows the monitoring-tagged user to erase evidence of brute-force login attempts...

rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write

A flaw was found in RabbitMQ, a messaging and streaming broker. A user with administrator privileges could exploit a path traversal vulnerability in the tracing plugin. By manipulating the name parameter, an attacker could write a .log-suffixed file to arbitrary filesystem paths writable by the...

rabbitmq-server: rabbitmq-server: Information disclosure via unredacted credentials in Shovel crash logs

A flaw was found in rabbitmq-server. When the Shovel plugin worker process crashes due to network or connection failures, it fails to sanitize its internal state before logging error reports. As a result, sensitive connection details and unencrypted credentials, including plaintext passwords, are...

rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs

A flaw was found in RabbitMQ, a messaging and streaming broker. When the Shovel plugin is enabled with URI-embedded credentials and debug logging is active, the completion of an autodelete shovel can cause decrypted AMQP Advanced Message Queuing Protocol URIs, including usernames and passwords, t...

rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions

A flaw was found in RabbitMQ. When the management plugin is configured with a wildcard Cross-Origin Resource Sharing CORS origin, it incorrectly reflects the attacker's origin and allows credentials. This vulnerability enables a malicious web page to leverage a signed-in administrator's cached...

CVE-2026-75092

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

CVE-2026-53495

A flaw was found in containerd. When the Container Runtime Interface CRI plugin is enabled on Linux, repeated use of CRI ExecSync by exec probes or lifecycle hooks can cause goroutines to become indefinitely blocked. This leads to resource exhaustion and can terminate the containerd process, maki...

CVE-2026-87791

creationtimestamp| type| source ---|---|--- 2026-09-15 08:45:08+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-...

CVE-2026-75092 Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

CVE-2026-75092 Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

CVE-2026-75092

CVE-2026-75092 is a local privilege escalation flaw in the scan_mysql actor of leapp-upgrade-el9toel10 (from the leapp-repository package). During RHEL 9 to RHEL 10 upgrades, the actor runs mysqld --validate-config directly as root , bypassing the packaged systemd unit that normally starts the da...

CVE-2026-75092

A privilege escalation flaw was found in the scanmysql actor of leapp-upgrade-el9toel10 provided by leapp-repository. During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL syste...

CVE-2026-15402

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...

CVE-2026-18063

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...