PT-2026-51042

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An authentication logic flaw exists where a user authorized to manage team or organization security settings can enforce mandatory two-factor authentication 2FA for all team members without having 2...

adoptrank (>=0.1.0, <=0.2.1), agent-nexus-cli (>=0.1.0, <=0.1.31) +175 more potentially affected by CVE-2026-58203 via pydantic-settings (>=2.12.0, <=2.14.1)

pydantic-settings PYPI version =2.12.0, =0.1.0, =0.1.0, =0.1.0, =0.6.1rc1, =0.1.0, =1.6.6, =0.4.3, =1.0.0, =0.11.0, =0.26.0, =0.10.0, =0.5.8, =2.0.1, =3.7.4 and more Source cves: CVE-2026-58203 Source advisory: SNYK:PYTHON-PYDANTICSETTINGS-17675228...

adoptrank (>=0.1.0, <=0.2.1), agent-nexus-cli (>=0.1.0, <=0.1.31) +175 more potentially affected by unknown CVE via pydantic-settings (>=2.12.0, <=2.14.1)

pydantic-settings PYPI version =2.12.0, =0.1.0, =0.1.0, =0.1.0, =0.6.1rc1, =0.1.0, =1.6.6, =0.4.3, =1.0.0, =0.11.0, =0.26.0, =0.10.0, =0.5.8, =2.0.1, =3.7.4 and more Source cves: unknown CVE Source advisory: GHSA-4XGF-CPJX-PC3J...

adoptrank (>=0.1.0, <=0.2.1), agent-nexus-cli (>=0.1.0, <=0.1.31) +175 more potentially affected by CVE-2026-58203 via pydantic-settings (>=2.12.0, <=2.14.1)

pydantic-settings PYPI version =2.12.0, =0.1.0, =0.1.0, =0.1.0, =0.6.1rc1, =0.1.0, =1.6.6, =0.4.3, =1.0.0, =0.11.0, =0.26.0, =0.10.0, =0.5.8, =2.0.1, =3.7.4 and more Source cves: CVE-2026-58203 Source advisory: OSV:GHSA-4XGF-CPJX-PC3J...

Symlink Attack

Overview pydantic-settings is a Settings management using Pydantic Affected versions of this package are vulnerable to Symlink Attack in the NestedSecretsSettingsSource process when secretsnestedsubdir is enabled and a symbolic link inside the configured secrets directory points outside of it. An...

OPENSUSE-SU-2026:21108-1 Security update for ignition

This update for ignition fixes the following issue - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265751...

Malicious code in base_parts_ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b0e2bcf47f6720470181fe18dda70621d52a4fb65fec395a87e14ec39c5219 When a user runs the package's jcc or jcx CLI, lib/aiutils.js polls https://jai.jaskle.cn/hm/hmpub/aicccfg for a newVer value and, if it differs from...

MAL-2026-6228 Malicious code in base_parts_ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b0e2bcf47f6720470181fe18dda70621d52a4fb65fec395a87e14ec39c5219 When a user runs the package's jcc or jcx CLI, lib/aiutils.js polls https://jai.jaskle.cn/hm/hmpub/aicccfg for a newVer value and, if it differs from...

CVE-2026-4026

The CVE-2026-4026 entry affects FlexNet Manager Suite 2025 R1. An authenticated user with read-only access to account settings can escalate privileges to Administrator. The issue has a CVSS 4.0 base score of 8.7 (HIGH) with attack vector Network, low attack complexity, and no user interaction req...

CVE-2026-4026 FlexNet Manager Suite Privilege Escalation Vulnerability

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings to escalate their privileges to Administrator level...

CVE-2026-12430

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and...

CVE-2026-12430

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and...

CVE-2026-11775

The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the useradminsimplifieroptionspage function. This makes it possible for unauthenticated attackers to rese...

CVE-2026-11775 User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery

The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the useradminsimplifieroptionspage function. This makes it possible for unauthenticated attackers to rese...

CVE-2026-11775 User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery

The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the useradminsimplifieroptionspage function. This makes it possible for unauthenticated attackers to rese...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

PT-2026-50881

Name of the Vulnerable Software and Affected Versions FlexNet Manager Suite 2025 R1 Description An issue exists where an authenticated user with read-only access to account settings can escalate their privileges to the Administrator level. Recommendations At the moment, there is no information...

CVE-2026-4026: Improper Access Control

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could allow an authenticated user with read-only access to account settings to escalate their privileges to Administrator level...

CVE-2026-12430: Improper Neutralization of Input During Web Page Generation

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and...

PT-2026-55944

Name of the Vulnerable Software and Affected Versions pydantic-settings versions 2.12.0 through 2.14.1 Description The NestedSecretsSettingsSource reads secret values from files within a configured secrets dir. When the secrets nested subdir variable is set to true, the system follows symbolic...