CVE-2026-92548

The WP Popular Posts plugin for WordPress (versions up to and including 7.4.2 ) is vulnerable to Sensitive Information Exposure . Unauthenticated attackers can extract sensitive edit-context fields—such as raw title, raw content body, password, meta, status, and guid—from non-public post objects ...

CVE-2026-92548 WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters

The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body,...

EUVD-2026-90466

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-91109 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-91109 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-91109

The Simply Schedule Appointments plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 1.6.12.31 . The root cause is a lack of validation on a user-controlled key within the 'complete_group' parameter. Authenticated attackers with subscri...

Chromium CVE-2026-93375: Incorrect reference resolution in Tracing

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

MAL-2026-17437 Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

CVE-2026-92537

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in versions up to and including 9.3.9 . The public click-tracking REST route /tnp/l/ allows unauthenticated attackers to receive a subscriber's permanent raw authenticati...

CVE-2026-92537 Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permissioncallback = 'returntrue' and, upon receiving...

SUSE CVE-2026-13719

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...

SUSE CVE-2026-97590

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with PAES algorithm In function ctrpaesdocrypt there is a buffer used to process remaining bytes AESBLOCKSIZE. This buffer was not scrubbed and thus could lead to expose of unwanted...

SUSE CVE-2026-97592

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm In function ctraescrypt there is a buffer used to process remaining bytes AESBLOCKSIZE. This buffer was not scrubbed and thus could lead to expose of...

SUSE CVE-2026-97907

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...

SUSE CVE-2026-97929

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

CLEANSTART-2026-LG89593 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the cri-tools package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CLEANSTART-2026-XE09130 Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination aft...

Security vulnerability affects the apache-nifi package. Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login...

SUSE CVE-2026-103436

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar in src/cgi/upsfetch.c used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf"%s %s %s", answer performs no...

ruby:2.5 security update

An update is available for module.ruby, module.rubygem-bundler, rubygem-mysql2, rubygem-bson, rubygem-bundler, module.rubygem-bson, rubygem-pg, rubygem-mongo, module.rubygem-mysql2, ruby, module.rubygem-abrt, module.rubygem-mongo, module.rubygem-pg, rubygem-abrt. This update affects Rocky Linux 8...