CVE-2026-27999 WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Tourfic = 2.23.1 versions...

Fedora 43 : python-asyncssh (2026-574496d9ae)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-574496d9ae advisory. import asyncssh 2.23.1 Fix CVE-2026-54590: Unauthorized file modification via authorized-keys directory escape Fix CVE-2026-54591: Arbitrary file...

CVE-2026-54591

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../...

UBUNTU-CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...

CVE-2026-54591

AsyncSSH (Python) prior to 2.23.1 is vulnerable to SCP path traversal: a malicious SSH server can craft filenames with ../, since _parse_cd_args returns server-provided names verbatim and _recv_files joins them to the destination path without enforcing directory boundaries, enabling arbitrary fil...

CVE-2026-54591

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../...

CVE-2026-54591 AsyncSSH: SCP Path Traversal to Arbitrary File Write

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../...

CVE-2026-54591 AsyncSSH: SCP Path Traversal to Arbitrary File Write

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../...

PYSEC-2026-1064 Open redirect in web2py

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack...

Linux Distros Unpatched Vulnerability : CVE-2026-12804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of...

OPENSUSE-SU-2026:11042-1 python311-asyncssh-2.23.1-1.1 on GA media

These are all security issues fixed in the python311-asyncssh-2.23.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10353-1 ruby4.0-rubygem-loofah-2.23.1-1.5 on GA media

These are all security issues fixed in the ruby4.0-rubygem-loofah-2.23.1-1.5 package on the GA media of openSUSE Tumbleweed...

CVE-2026-24555

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored XSS.This issue affects ArtPlacer Widget: from n/a through = 2.23.2...

CVE-2026-24555

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored XSS.This issue affects ArtPlacer Widget: from n/a through = 2.23.2...

CVE-2026-24555

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored XSS.This issue affects ArtPlacer Widget: from n/a through = 2.23.1...

CVE-2026-24555 WordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored XSS.This issue affects ArtPlacer Widget: from n/a through = 2.23.2...

CVE-2026-24555

CVE-2026-24555 : WordPress ArtPlacer Widget (artplacer-widget) is affected by a stored XSS due to improper input handling in the package’s web page generation. Affected product/version: ArtPlacer Widget up to and including 2.23.1. Evidence from multiple sources confirms the vulnerability and the ...

PT-2026-4397

Name of the Vulnerable Software and Affected Versions artplacer ArtPlacer Widget versions through 2.23.1 Description The ArtPlacer Widget contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This can potentially allow an...

WordPress plugin ArtPlacer Widget has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress ArtPlacer Widget plugin <= 2.23.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jitlada in WordPress Plugin ArtPlacer Widget versions = 2.23.1...