CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...

EUVD-2026-53582

praisonaiagents has a webcrawl SSRF protection bypass via unchecked redirect targets...

Moderate: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

Important: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

WordPress Subscriptions for WooCommerce plugin < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token vulnerability

Payment Bypass via Attacker-Supplied PayPal Capture Token vulnerability discovered by Pedro Pinho in WordPress Plugin Subscriptions for WooCommerce versions 2.0.1...

CVE-2026-78886

CVE-2026-78886 is a path traversal vulnerability in liketrek TREK (versions up to 3.0.22 ), affecting an unknown function within the file server/src/nest/journey/journey-public.controller.ts of the Public Journey Photo Proxy component. An unauthenticated remote attacker can exploit this with high...

ROOT-OS-DEBIAN-12-CVE-2026-59999 CVE-2026-59999 in openssh - Patched by Root

Root has patched CVE-2026-59999 in the openssh package for Root:Debian:12. Multiple fixed versions available...

UBUNTU-CVE-2026-79657

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-78864 liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection

A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation causes sql injection. It is possible to initiate the atta...

CVE-2026-49050

Apache DolphinScheduler versions prior to 3.4.2 are vulnerable to an incorrect authorization flaw. A general user can exploit the /access-tokens endpoint to mint admin access tokens , potentially leading to unauthorized administrative access. To remediate this issue, users are recommended to upgr...

ROOT-OS-DEBIAN-12-CVE-2021-46312 CVE-2021-46312 in djvulibre - Patched by Root

Root has patched CVE-2021-46312 in the djvulibre package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2023-53154 CVE-2023-53154 in cjson - Patched by Root

Root has patched CVE-2023-53154 in the cjson package for Root:Debian:12. Multiple fixed versions available...

WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by lanlv - HPT Vietnam Coporation in WordPress Plugin WP w3all phpBB versions = 3.0.6...

WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...

MGASA-2026-0337 Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links...

WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by JunHee CHO in WordPress Plugin Beautiful Taxonomy Filters versions = 2.4.6...

WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Aydan Arabadzha in WordPress Plugin Realtyna Organic IDX plugin versions = 5.4.1...

WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by G0053 in WordPress Theme CozyStay versions = 1.10.0...

CVE-2026-78656

itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/cust_del.php, triggered by manipulation of the ID argument. The flaw can be exploited remotely with low privileges required (authenticated user) and no user interaction, yielding low impact...