EUVD-2026-112604

The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete t...

AlmaLinux 8 : pki-deps:10.6 (ALSA-2026:90909)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:90909 advisory. com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing...

CVE-2026-93293: saadiqbal Password Protected – Protect Your Site Content With a Password: The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's…

The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete t...

PT-2026-130632

The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete t...

RHEL 8 : pki-deps:10.6 (RHSA-2026:90909)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90909 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes:...

Alibaba Cloud Linux 3 : 0329: vim (ALINUX3-SA-2026:0329)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0329 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-73073: Vim is an open source, command line...

CVE-2026-99189

In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that...

CVE-2026-116531

The HTTP::Body Perl module (versions before 1.23_01 ) is vulnerable to a flaw where it loses track of chunk boundaries in chunked request bodies if a read operation ends inside a chunk. The add() function may treat a chunk as complete prematurely or leave the parser unable to reach the 'done' sta...

CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...

CVE-2026-59185

identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on "POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete" endpoint in "internal/api/router.go" accepts "installationid" from the request body or...

EUVD-2026-111905

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

CVE-2026-99153

The Linux kernel contains a vulnerability in the libiscsi component where it fails to properly validate the ITT (iSCSI Task Tag) reflected in a Reject PDU . Specifically, the iscsi_handle_reject() function takes the ITT directly from the rejected header without sufficient validation. An attacker-...

CVE-2026-99153

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsihandlereject takes the ITT out of that copy to find the task to clean up: memcpy&rejectedpdu, data,...

PT-2026-128146

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.273 Description An issue exists in the libiscsi component of the Linux kernel where the iscsi handle reject function fails to properly validate the iSCSI Task Tag ITT reflected in a Reject PDU. Because the...

SUSE CVE-2026-99046

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing o...

WordPress PayDunya WooCommerce Payment Gateway plugin <= 1.1.6 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PayDunya WooCommerce Payment Gateway versions = 1.1.6...

CVE-2026-103359 PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers...

CVE-2026-103359

The PayDunya WooCommerce Payment Gateway WordPress plugin, version 1.1.6 and below , contains a vulnerability where it fails to verify the authenticity of incoming payment notifications. Until the gateway is configured, the plugin authenticates these notifications using a value derived from an em...

Updated vim package fixes security vulnerabilities

Ex Command Injection via Unescaped Buffer Name in signjump in Vim v9.2.1090 Arbitrary Code Execution via Ruby Omni-Completion in Vim 9.2.1177 Command Execution via Rmd Syntax Highlighting in Vim 9.2.1178 Ex Command Execution via Cargo Quickfix Hooks in Vim 9.2.1201...