CVE-2026-54837 WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Intranet & Private Site All-In-One Intranet = 1.8.1 versions...

WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP All Import versions = 4.0.1...

CVE-2026-13325

...

CVE-2026-13325

CVE-2026-13325 entry is rejected/not used and does not represent an active vulnerability.

PT-2026-52735

Unauthenticated Broken Access Control in Intranet & Private Site All-In-One Intranet = 1.8.1 versions...

PT-2026-52799

Administrator SQL Injection in WP All Import = 4.0.1 versions...

CVE-2026-54837: Missing Authorization

Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet = 1.8.1 versions...

PT-2026-53018

Name of the Vulnerable Software and Affected Versions linkify-it versions prior to 5.0.1 Description LinkifyIt.prototype.match the primary public API contains a structural issue in its JavaScript-level scan loop that results in ON² algorithmic complexity when processing inputs with numerous fuzzy...

CVE-2026-57628: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP All Import = 4.0.1 versions...

PT-2026-52690

Name of the Vulnerable Software and Affected Versions KubeVirt affected versions not specified Description A flaw exists in the migration proxy where setting spec.configuration.migrations.disableTLS to true on the KubeVirt custom resource causes the target virt-handler to bind a plain TCP listene...

CVE-2026-52999

A flaw was found in the Linux kernel's netfilter subsystem, specifically in the nfnetlinkosf module. When the NFOSFLOGLEVELALL option is configured, an out-of-bounds read vulnerability can occur during TCP option parsing. This issue can lead to incorrect data processing and logging failures,...

GO-2026-5759 go-zserio has Unbounded Memory Allocation for All Platforms in github.com/woven-planet/go-zserio

go-zserio has Unbounded Memory Allocation for All Platforms in github.com/woven-planet/go-zserio...

GO-2026-5586 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator in github.com/juev/nebula-mesh

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator in github.com/juev/nebula-mesh...

GO-2026-5401 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS in github.com/xyproto/algernon...

CVE-2026-11703

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

GO-2026-5300 Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: and no authentication in github.com/xyproto/algernon...

GO-2026-5215 Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator

Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces in github.com/metal3-io/ironic-standalone-operator...

CVE-2026-54448

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to...

CVE-2026-54448 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to...

CVE-2026-53245

In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrppduparsevecattr In mrppduparsevecattr, vector attribute events are encoded three per byte and valen tracks the number of events left to process. The parser decrements valen after...