CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-12106

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106 Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106

The Auto Upload Images plugin for WordPress (all versions up to and including 3.3.2 ) is vulnerable to a Limited Server-Side Request Forgery (SSRF) via the downloadImage function. The root cause is the use of wp_remote_get() instead of wp_safe_remote_get(), combined with a validate() method that ...

EUVD-2026-82730

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106 Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-40538: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-12106: Server-Side Request Forgery (SSRF)

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-54618

Obsidian Web MCP , a remote MCP server for Obsidian vaults, contained an authentication bypass prior to version 0.2.0. The /oauth/authorize endpoint issued an authorization code without any login, consent, or session check, and /oauth/token allowed exchanging that code for the static VAULT_MCP_TO...

CVE-2026-90139

In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fusefillsupersubmount fuseiget can return NULL when its inode allocation fails, but fusefillsupersubmount passed the result straight to getfuseinode and decremented fi-nlookup without checking i...

CVE-2026-91826

creationtimestamp| type| source ---|---|--- 2026-09-17 16:06:53+00:00| seen| https://bsky.app/profile/deafnews-auto.bsky.social/post/3mvpzwhigi62w...

GO-2026-6470 ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel

ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2026-92127

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

CVE-2026-92127

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

CVE-2026-33017-langflow-rce

CVE-2026-33017 — Langflow 未认证远程代码执行（RCE） 概述 CVE ID: CVE-2026-33017 受影响软件: Langflow 受影响版本: = 1.9.0 严重性: 严重 作者: r3nsi15 日期: 2026 描述 Langflow 暴露了一个公开的流程构建端点（/api/v1/buildpublictmp/flowID/flow），该端点接受任意 CustomComponent 代码块并在服务器端无需认证即可执行。通过将恶意 Python 载荷注入到 CustomComponent 节点的 code 字段，未经认证的攻击者可以以 Langfl...

memory-poisoning-axis

memory-poisoning-axis Deterministic memory-poisoning / prompt-injection measurement — anchored to CVE-2026-24301 "CoSnitch" Microsoft Copilot Personal, CVSS 3.1 8.8, patched 18 Aug 2026. CoSnitch chained: i automatic prompt execution ?q= + undocumented ?autorun=1, ii data exfiltration via...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a user installed an extension of a particular type, the extension might automatically update itself. During this process, it could bypass the prompt that grants the new version the newly requested permissions. This vulnerability affects Firefox 97, Thunderbird 91.6, and Firefox ESR 91.6...

Astra Linux – Vulnerability in Linux

A race condition in Linux kernel SCTP sockets net/sctp/socket.c before version 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If the sctpdestroysock function is called without using the socknetsk-sctp.addrwqlock lock, an element...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Disabled the automatic enable of exclusive INTx/IRQs. Currently, for devices that require masking at the irqchip for INTx, i.e., devices without DisINTx support, the IRQ is enabled in the requestirq function, and then...