Modoboa authorization issue vulnerability

Versions of Modoboa prior to 2.8.0 contained an authorization issue vulnerability. This vulnerability stemmed from insecure direct object references. Certified users could create automatic reply messages for any email address by providing the mbox value of another user. Attackers could also send...

CVE-2026-107648

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

CVE-2026-107648 WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

CVE-2026-107648

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.5 . The root cause is insufficient input sanitization and output escaping within several parameters, including action, function, plugin, p...

CVE-2026-107648 WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

EUVD-2026-102843

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by caussao in WordPress Plugin WP Sessions Time Monitoring Full Automatic versions = 1.1.5...

PT-2026-115582

Name of the Vulnerable Software and Affected Versions WP Sessions Time Monitoring Full Automatic versions prior to 1.1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts...

CVE-2026-107648: Improper Neutralization of Input During Web Page Generation

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...

activity-log.com WP Sessions Time Monitoring Full Automatic Cross-Site Script Vulnerability

activity-log.com WP Sessions Time Monitoring Full Automatic version 1.1.5 and earlier has a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for parameters such as action as well as function, plugin, posttype, poststatus, ids,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor bind path to use free After a bind/unbind cycle, the rndis-notifyreq remains stale. If a subsequent bind fails, the unified error label attempts to free this stale request, resulting in a NULL pointe...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Flush exception handling work when RPM level is zero Ensure that the exception event handling work is explicitly flushed during suspend when the runtime power management level is set to UFSPMLVL0. When the RPM...

EUVD-2026-101666

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...

CVE-2026-57493 FileRise: Remember-me auto-login uses stale admin role from token instead of current role

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...

CVE-2026-57493 FileRise: Remember-me auto-login uses stale admin role from token instead of current role

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...

CVE-2026-104767 Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user...

PT-2026-113592

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybe add role to user function unconditionally re-assigning every role stored in the dfxwcrc foreign roles...

PT-2026-113743

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description The connection cache match function fails to consider the automatic client certificate option. This allows a cached Schannel connection that was already authenticated to be reused for a...

WordPress Membership & User Roles for WooCommerce (Automatic Role Changer) plugin <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache vulnerability

Authenticated Subscriber+ Privilege Escalation to Stale Foreign Role Cache vulnerability discovered by Azgnt in WordPress Plugin DFX Automatic Role Changer for WooCommerce versions = 20260828...

CVE-2026-84320

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...