SUSE-SU-2026:3521-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

CVE-2026-1728

creationtimestamp| type| source ---|---|--- 2026-08-06 08:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dpb5ohyaumqjd 2026-08-06 09:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msfopqzrcd2f 2026-08-06 10:30:26+00:00| seen|...

CVE-2026-18050

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

CVE-2026-15991

creationtimestamp| type| source ---|---|--- 2026-08-06 06:02:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4sbtz6qg7nzt6 2026-08-06 07:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msfhtbrd3h2a 2026-08-06 08:54:07+00:00| seen|...

CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

EUVD-2026-53727

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

CVE-2026-18050

CVE-2026-18050 affects the WordPress plugin Events Manager up to version 7.3. It describes an unauthenticated disclosure vulnerability on a REST route that serves temporarily stored file uploads, where an attacker can retrieve another user’s in-progress upload if they know the temporary identifie...

CVE-2026-71315

creationtimestamp| type| source ---|---|--- 2026-08-05 22:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msejmylyml2t 2026-08-05 22:14:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/g56cs2qf35unw 2026-08-06 05:31:22+00:00| seen|...

EUVD-2026-53386

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

CVE-2026-17613

Penpot’s ::import-binfile RPC command is reported as lacking authorization on the optional file-id parameter. The vulnerability allows any authenticated user to overwrite arbitrary files on the target server and subscribe to WebSocket events, which can enable full data exfiltration and data poiso...

CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

CVE-2026-9273

creationtimestamp| type| source ---|---|--- 2026-08-05 06:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/117041373701599609 2026-08-05 06:00:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msctyppdsc2t 2026-08-05 07:04:04+00:00| seen|...

WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mukhlis Amien in WordPress Plugin Events Manager versions = 7.4.2...

CVE-2026-18754

creationtimestamp| type| source ---|---|--- 2026-08-04 09:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msanlkacge2l 2026-08-04 09:54:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/befdrlvqqqlb5 2026-08-04 13:32:06+00:00| seen|...

EUVD-2026-52580

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

CVE-2026-16536 Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

RockyLinux 8 : kernel-rt (RLSA-2026:49213)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49213 advisory. kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack...

CVE-2026-18589

creationtimestamp| type| source ---|---|--- 2026-08-03 06:36:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5v2fnayl2p 2026-08-03 07:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/117030402699172268 2026-08-03 07:30:32+00:00| seen|...

CVE-2026-10848

creationtimestamp| type| source ---|---|--- 2026-08-02 18:50:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4nlsi2o42p 2026-08-02 19:07:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4olaqzdj2e...

CVE-2026-67332

creationtimestamp| type| source ---|---|--- 2026-08-01 22:33:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2jmj437s22 2026-08-01 22:33:46+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3ms2jmyhpza25 2026-08-01 23:09:05+00:00| seen|...