CVE-2026-91832: Improper Neutralization of Input During Web Page Generation

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

PT-2026-103031

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

PT-2026-103301

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.2 JetBrains TeamCity versions prior to 2026.1.4 JetBrains TeamCity versions prior to 2025.11.8 Description Authenticated users can execute arbitrary commands on Windows servers. This is possible throug...

PT-2026-103305

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Missing authorization allows users with read-only permissions to access and read project settings. Recommendations Update to version 2026.2.18991...

CVE-2026-100261: Authentication Bypass Using an Alternate Path or Channel

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission...

PT-2026-103300

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.2 JetBrains TeamCity versions prior to 2026.1.4 JetBrains TeamCity versions prior to 2025.11.8 Description A sandbox escape allows for remote code execution through the versioned settings Kotlin DSL...

CVE-2026-100254: Improper Neutralization of Special Elements used in an OS Command

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings...

CVE-2026-62308: Server-Side Request Forgery (SSRF)

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-89190: Improper Access Control

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

Linux Distros Unpatched Vulnerability : CVE-2026-101898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy setting...

PT-2026-103041

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

AZL-105663 CVE-2026-97687 affecting package python-urllib3 2.0.7-6

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

EUVD-2026-89016

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

CVE-2026-100286

The Devolutions Server (version 2026.3.5.0 and earlier) is affected by a missing authorization vulnerability in the data source settings API . This flaw allows an authenticated non-administrative user to disclose integration secrets by sending a crafted API request. Exploitation details are not p...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

firefox: thunderbird: Sandbox escape in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...

firefox: thunderbird: Mitigation bypass in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Remote Settings Client component...

CVE-2026-100286: Exposure of Sensitive Information to an Unauthorized Actor

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

PT-2026-102641

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...