ALSA-2026:68291 Moderate: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

PT-2026-93306

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

RHEL 10 : unbound (RHSA-2026:68291)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68291 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: DNS cache poisoning via...

SUSE CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

CVE-2026-73437

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...

CVE-2026-83043

creationtimestamp| type| source ---|---|--- 2026-09-15 22:14:51+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlnklqpcj2y 2026-09-16 00:20:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlukmtvx624 2026-09-22 07:37:06+00:00| seen|...

CVE-2026-83006

creationtimestamp| type| source ---|---|--- 2026-09-15 22:13:01+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvlnhc4xbq2b 2026-09-15 23:20:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlr7dre3a2g 2026-09-23 09:49:50+00:00| seen|...

CVE-2026-70757

creationtimestamp| type| source ---|---|--- 2026-09-15 21:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvll2jfxeb2g 2026-09-15 22:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvln6xk4nw22 2026-09-16 12:05:07+00:00| seen|...

CVE-2026-73437 On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...

CVE-2026-73437

Arista EOS DHCP relay is vulnerable to spoofed DHCP reply forwarding (CWE-345). An unauthenticated attacker on an adjacent network can send crafted DHCP reply packets from a non-helper IP address, which the relay forwards to clients without source validation, potentially supplying malicious netwo...

CVE-2026-19886

creationtimestamp| type| source ---|---|--- 2026-09-15 20:13:28+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvlgrkta4a2i...

CVE-2026-69213

creationtimestamp| type| source ---|---|--- 2026-09-15 20:03:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg7l7nfi2e 2026-09-16 13:32:29+00:00| seen| https://gist.github.com/alon710/27956b315c2388b848451081f38450c3...

CVE-2026-85234

creationtimestamp| type| source ---|---|--- 2026-09-15 19:31:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/azqvrwahpwbnb...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-92177

creationtimestamp| type| source ---|---|--- 2026-09-15 19:13:15+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvldfv6e752c 2026-09-15 20:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg22dequ23...

CVE-2026-92176

creationtimestamp| type| source ---|---|--- 2026-09-15 19:13:14+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvldftil4u2q 2026-09-15 20:03:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg7deuc522...

EUVD-2026-79187

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...