AZL-97674 CVE-2026-63076 affecting package openssl-fips-provider 3.1.2-2

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

AZL-97941 CVE-2026-63076 affecting package openssl for versions less than 3.3.7-6

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

CVE-2026-63076

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

Security update for postgresql16

This update for postgresql16 fixes the following issues: CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. CVE-2026-6470: failure to check type USAGE privilege...

CVE-2026-77997

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

WordPress Tutor LMS plugin < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass vulnerability

Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass vulnerability discovered by John Umoru in WordPress Plugin Tutor LMS versions 3.9.14...

EUVD-2026-65472

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

CVE-2026-77997 Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

CVE-2026-77997 Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

CVE-2026-77997

YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.41 contain a missing access check that allows authenticated users holding com_template editing permissions to view information about arbitrary site modules without the corresponding com_modules permissions. This constitu...

CVE-2026-79667

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-59335

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

CVE-2026-74676

A flaw was found in the Linux kernel. A missing permission check in the KDSKBMETA ioctl input/output control allows a local process to modify the keyboard meta mode on a non-controlling console without proper authorization. This could enable an attacker to make unauthorized changes to system...

CVE-2026-77142

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

CVE-2026-77144

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-77145

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...

CVE-2026-77141

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activa...

CVE-2026-77141 Broken Access Control in extension "Club Directory" (clubdirectory)

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activa...