GO-2024-2842 vulnerabilities

Vulnerabilities for packages: zot, buildah, skopeo...

GO-2026-5418 vulnerabilities

Vulnerabilities for packages: argo-cd, argocd-image-updater...

GO-2025-4024 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2025-4223 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HaiND in WordPress Plugin Ezoic versions = 2.22.11...

CVE-2026-16739

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a...

GHSA-JGV4-5FJV-3XP7 vulnerabilities

Vulnerabilities for packages: consul, consul-fips...

CVE-2026-19016 vulnerabilities

Vulnerabilities for packages: consul, consul-fips...

GHSA-7QHJ-3FG3-MH5R vulnerabilities

Vulnerabilities for packages: consul, consul-fips...

GHSA-JGRX-MGXX-JF9V vulnerabilities

Vulnerabilities for packages: arangodb...

PT-2026-72127

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An issue exists in the external Lightweight Directory Access Protocol LDAP authentication handling. When an LDAP referral is returned during the authentication process, the system fails ...

PT-2026-72122

Name of the Vulnerable Software and Affected Versions Laravel Socialite affected versions not specified Description The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in...

PT-2026-72124

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.7 alpha1 through 2.7.5 Description When using mbedTLS, remote authenticated users can be misidentified because the system ignores the configured X.509 username identity lookup field. X.509 is a standard for public key...

VulnCheck KEV: CVE-2026-59309

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...

Cisco Firewall Threat Defense (FTD) Software Remote Access SSL VPN DoS (cisco-sa-asaftd-vpn-dos-dzv4mQFF)

According to its self-reported version, the Cisco Secure Firewall Threat Defense FTD Software is affected by a denial of service vulnerability. A flaw exists due to insufficient error checking when processing HTTP requests. An unauthenticated, remote attacker can exploit this issue, via a crafted...

Security Updates for Azure CycleCloud < 8.9.1

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities: - Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. CVE-2026-57969 - An improper input...

Exim: Multiple Vulnerabilities

Background Exim is a message transfer agent MTA designed to be a a highly configurable, drop-in replacement for sendmail. Description Multiple vulnerabilities have been discovered in Exim. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE...

PT-2026-72047

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

Debian dla-4740 : libecpg-compat3 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4740 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4740-1 [email protected]...

6Storage Rentals < 2.29.0 - Unauthenticated Account Takeover via 'email' Parameter

Description The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.28.0 This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownersh...