CVE-2026-80433

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

curl: CVE-2026-86411: FTP connection reuse inherits client-certificate

Summary An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues ...

EUVD-2026-66948

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-80433

SureFeedback Client Site is a WordPress plugin vulnerable to Subscriber-level Sensitive Data Exposure in versions 1.2.12 and below . The CVSS 3.1 score is 7.5 (High) , with a network attack vector requiring no privileges or user interaction, and a high impact on confidentiality but no impact on i...

CVE-2026-80433 WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

CVE-2026-80527

A flaw was found in the Linux kernel's Ceph client. A reader can experience an indefinite hang when the client's local capability state mdswanted becomes stale after a Metadata Server MDS capability revocation. This occurs because the client believes it still wants a capability e.g., FILERD that...

CVE-2026-59354

Spring Security's OAuth2 Authorization Server module (versions 7.0.0 through 7.0.4 ) is affected by insufficient validation of client metadata fields at the Dynamic Client Registration endpoint. When Dynamic Client Registration is explicitly enabled, an attacker holding a valid Initial Access Tok...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

EUVD-2026-66977

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

[SECURITY] Fedora 43 Update: openssh-10.0p1-12.fc43

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

SUSE CVE-2026-68569

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

SUSE CVE-2026-74316

In the Linux kernel, the following vulnerability has been resolved: NFSD: Handle layout stid in nfsd4droprevokedstid nfsd4droprevokedstid has no SCTYPELAYOUT case, so when a client sends FREESTATEID for an admin-revoked layout stid, the default branch releases cllock and returns without unhashing...

PT-2026-82467

Subscriber Sensitive Data Exposure in SureFeedback Client Site = 1.2.12 versions...

PT-2026-82489

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

PT-2026-85187

openssl encrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...