WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MCP Content Manager Lite versions = 1.1.0...

WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Zahid Abbasi in WordPress Plugin FormGent versions = 1.12.2...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to undici and nodemailer.

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to undici and nodemailer. Vulnerability Details CVEID:CVE-2026-13697 DESCRIPTION: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0....

WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Morato Antoine in WordPress Plugin WP Express Checkout Accept PayPal Payments versions = 2.4.9...

Anjvision YSSD-RTMP-H5

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the...

CVE-2026-97561

A flaw was found in the Linux kernel's Server Message Block SMB client. When an administrator mounts a remote share with options configured to force specific local user and group ownership, the client fails to enforce these restrictions and instead accepts ownership values provided by the remote...

CLEANSTART-2026-ZY12459 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...

CLEANSTART-2026-QU92900 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles malformed Cache-Control private directives...

EUVD-2026-88567

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

EUVD-2026-88563

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

PT-2026-102759

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txm module manager memory load / txm module manager in place load — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXM MODULE PREAMBLE is full...

CVE-2026-84784: Allocation of Resources Without Limits or Throttling

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

Linux Distros Unpatched Vulnerability : CVE-2026-75804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the...

Fedora 43 : perl-Catalyst-Plugin-Static-Simple (2026-7c46481544)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7c46481544 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

PT-2026-108601

Security vulnerability affects the langfuse package. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive...

CVE-2026-92226: Improper Access Control

Joomla! Core - 20260913 - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items...

CVE-2026-102711: Out-of-bounds Read

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102568: Incorrect Authorization

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...

CVE-2026-102730: Out-of-bounds Write

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2025-33207: Improper Access Control for Register Interface

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...