CVE-2026-102790

The iCagenda Joomla extension (versions 3.2.1 to 4.0.16 ) is vulnerable to Authenticated Stored XSS (CVE-2026-102790). The root cause is that a url-type event custom field submitted via the front-end event submission form is printed into a link without proper escaping or scheme validation. This a...

CVE-2026-102790 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16...

WordPress Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter vulnerability

Authenticated Shop Manager+ Privilege Escalation to 'page' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin WpEvently versions = 5.7.8...

CVE-2026-99166 net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-99166

The Linux kernel contains a vulnerability in the RDS (RDMA Sports) protocol where an uninitialized trans pointer in the rds_rdma_cm_event_handler_cmn() function causes a kernel crash. The issue occurs because trans is only assigned when the RDMA device is an InfiniBand CA ; on other devices like ...

CVE-2026-99166 net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

CVE-2026-109381

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.7.8 . The vulnerability exists in the mep_grant_shop_manager_access() function, which hooks into user_has_cap and unconditionally grants the manage_options capability. This occurs when...

CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

SUSE CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

CVE-2026-99166: Linux: In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM…

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

PT-2026-129144

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy Files Selector pattern causing...

PT-2026-128118

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perf event throttle -- PMU-stop Shortly later t...

PT-2026-128159

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds rdma cm event handler cmn assigns trans only when the RDMA device is an InfiniBand CA RDMA NODE IB CA. On any other device type, e.g. an iWARP RNIC such as siw...

MiracleLinux 9 : freeipmi-1.6.20-1.el9_8 (AXSA:2026-2180:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2180:05 advisory. FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses CVE-2026-85504 FreeIPMI: FreeIPMI: Arbitrary code...

PT-2026-129093

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

CVE-2026-118246: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

PT-2026-129088

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-116797: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

DEBIAN-CVE-2026-57190

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends celpgsql and celtds may permit arbitrary SQL execution when untrust...