CVE-2026-79362

Certain Woltlab products are vulnerable to Remote Code Execution (RCE) via Cache Poisoning in the WCF component. The vulnerability affects versions WCF >= 6.1.0 until = 6.2.0 until

PT-2026-89902

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

PT-2026-90476

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management swap system where a hibernation slot is incorrectly freed while it is still present in the swap cache. This occurs because the swap free...

CVE-2026-79362: Improper Control of Generation of Code

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

PT-2026-89678

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.3.4 and later Description The nscd service in the GNU C Library may experience a stack overflow when processing an oversized response from a malicious DNS server. This occurs when the service handles DNS records large...

CVE-2026-89263: Missing Authentication for Critical Function

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

openSUSE 16: libzypp / libzypp-devel / zypper / zypper-aptitude / zypper-log / etc (openSUSE-SU-2026:21808-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21808-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. Non security issues fixed: - Eco...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107292)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107292 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayedwork on cachectr error An unexpected WARNON from...

Linux Distros Unpatched Vulnerability : CVE-2026-89092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query,...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an insecure direct object reference (IDOR) flaw that allows a remote authenticated attacker to manipulate runtime caches and cause a denial of service . The vulnerability carries a CVSS 3.1 score of 7.4 (HIGH) , with a scope change indica...

EUVD-2026-75702

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

CVE-2026-88059 Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to cert-manager ( CVE-2026-25518 )

Summary Potential vulnerabilities in cert-manager package CVE-2026-25518 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-25518 DESCRIPTION: cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and...

taky-cache-loop (0.0.1), taky-redis-throttle (0.0.1) potentially affected by unknown CVE via every-time (0.0.0)

every-time NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on every-time and may be impacted: - taky-cache-loop 0.0.1 - taky-redis-throttle 0.0.1 Source cves: unknown CVE Source advisory: GHSA-W785-48P4-H5JJ...

CVE-2026-15889

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics

CVE-2022-24637 — Open Web Analytics prior to 1.7.4 Defensiv...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

SummaryThe CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless of...

PYSEC-2026-3824 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

coderedcms (>=2.0.0, <=2.1.4), puput (1.2.0) +27 more potentially affected by CVE-2026-55468 via wagtail (4.2.4)

wagtail PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =2.0.0, =0.1.0, =0.3.4, =0.0.1, =1.6.0, =0.18.0, =0.19.2 - wagtail-hallo 0.3.0 - wagtail-images-deduplicator 1.0.0a1 and more Source...