PT-2026-103021

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...

CVE-2026-47567: Uncontrolled Resource Consumption

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service...

PT-2026-103313

🚨 CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address 🎖@cveNotify...

PT-2026-103048

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778129970)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778129970 advisory. - During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the...

Linux Distros Unpatched Vulnerability : CVE-2026-100820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788960930)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788960930 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788960930)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788960930 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter...

PT-2026-103415

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-102312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page...

AlmaLinux 9.2 [TuxCare] Security Update: compat-openssl11 (ALMALINUX9.2:CLSA-2025:1764692769)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764692769 advisory. - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an...

NPM: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

NPM: ip-address: isInSubnet and isHostInSubnet compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101912 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101912 Source advisory: OSV:GHSA-J6R3-76F7-8JCV...

GHSA-J6R3-76F7-8JCV ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

Summary isInSubnet and isHostInSubnet accept an address of either family and compare masked binary strings without checking that both operands are the same family. Address4 pads to 32 bits and Address6 to 128, so whenever the leading bits agree the strings are equal: new...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101911 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101911 Source advisory: OSV:GHSA-H3MG-XC3C-68PW...

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +143 more potentially affected by CVE-2026-101911 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =3.3.0, =1.5.40, =1.6.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.119 and more Source cves: CVE-2026-101911 Source advisory: GHSA-H3MG-XC3C-68PW...

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

NPM: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process vulnerability discovered by ? in WordPress Npm ip-address versions = 10.7.0...

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

GHSA-G57G-F23G-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...