Astra Linux – Vulnerability in Wireshark

The NTLMSSP dissector crash in Wireshark versions 4.2.0 to 4.0.6, as well as 4.0.0 to 4.0.16, allows for denial of service through packet injection or malicious capture files...

WordPress Tutor LMS plugin 4.0.0-4.0.6 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Tutor LMS versions 4.0.6...

PT-2026-81055

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

ruby4.0 security, bug fix, and enhancement update

4.0.6-36 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660...

ruby:4.0 security, bug fix, and enhancement update

ruby 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 rubygem-mysql2 0.5.7-1 - Upgrade to mysql2 0.5.7. Related: RHEL-142278 0.5.5-3 - Disable tests on the 32bit platforms ix86. Related: RHEL-80222 0.5.5-2 - Adapt tests to openssl 3.2 Resolves: RHEL-80222 rubygem-pg...

CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...

PT-2026-63937

Name of the Vulnerable Software and Affected Versions Visualizer versions prior to 4.0.7 Description Themeisle Visualizer contains an issue involving improper neutralization of special elements used in an SQL command, which allows for Blind SQL Injection. This occurs specifically through the...

CVE-2026-63071

Apache Syncope is vulnerable to an Improper Isolation or Compartmentalization flaw due to a bypass in the Groovy security sandbox (specifically the GroovySandboxScriptEngineImpl in the core/spring module). An administrator with entitlements to manage Implementations can create a malicious Groovy ...

EUVD-2026-45955

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

[SECURITY] Fedora 44 Update: ruby-4.0.6-36.fc44

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

CVE-2026-11909

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6...

CVE-2026-11909 Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6...

Security update for transmission (moderate)

openSUSE Security Update: Security update for transmission Announcement ID: openSUSE-SU-2026:0237-1 Rating: moderate References: 1267404 Cross-References: CVE-2026-38978 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...

CVE-2026-6556 @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

CVE-2026-6556

The CVE concerns @fastify/express 4.0.6 and earlier, where non-string mount paths (arrays/regex) are not prefixed inside prefixed plugin scopes. This causes middleware registered with those forms to not match the actual prefixed request path, potentially bypassing path-scoped security middleware ...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the property-lookup cache. An attacke...

Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via the MappingContext property path resolution. An attacker can cause...

CVE-2026-42747

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through = 4.0.6...