CVE-2026-18035 User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...

CVE-2026-12976 LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

EUVD-2026-57072

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in...

PT-2026-71018

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups...

Important: abrt security update

The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality. Security Fixes: abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump...

Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

PT-2026-71195

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged user can poison cached artifact metadata under specific conditions. This action may lead consumers to retrieve untrusted content. Recommendation...

PT-2026-80511

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead. In theory, this bug could enable HTTP request/response smuggling. This vulnerability is fixed in...

CVE-2026-69105: Insufficient Verification of Data Authenticity

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...

CVE-2026-68754: Missing Authorization

A repository publisher without delete permission may modify protected package content under specific conditions...

PT-2026-75906

This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...

PT-2026-75908

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

PT-2026-76588

Name of the Vulnerable Software and Affected Versions Drupal Entity Share Websub versions 0.0.0 through 1.1.2 Description Insufficient validation of certain inputs allows an attacker to perform Server-Side Request Forgery SSRF, a technique where the server is coerced into making unauthorized...

PT-2026-71109

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A repository publisher who lacks delete permissions may be able to modify protected package content under specific conditions, specifically by overwriting docker...

PT-2026-71215

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an analytics dashboard component fails to properly neutralize user-controlled value...

CVE-2026-69106: Improper Input Validation

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

ALSA-2026:54272 Important: abrt security update

The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality. Security Fixes: abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump...

AlmaLinux 8 : abrt (ALSA-2026:54272)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54272 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds during...

Vulnerability of the Microsoft SharePoint Online content management software, related to spear-phishing attacks

The vulnerability of the Microsoft SharePoint Online content management software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

DEBIAN-CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...