PT-2026-122571

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

Linux Distros Unpatched Vulnerability : CVE-2026-115572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect...

Amazon Linux 2 : qemu (ALAS-2026-4027)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4027 advisory. hw/display/qxl: validate primary surface stride against width CVE-2026-16271 hw/usb/hcd-xhci: Set reentrancy guard in timer...

PT-2026-122603

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and...

PT-2026-122587

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

Important: mariadb118

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the...

Important: mariadb123

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the...

Important: mariadb114

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the...

Important: mariadb1011

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the...

PT-2026-122581

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122573

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122585

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122572

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

Linux Distros Unpatched Vulnerability : CVE-2026-115722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value typ...

Important: qemu

Issue Overview: hw/display/qxl: validate primary surface stride against width CVE-2026-16271 hw/usb/hcd-xhci: Set reentrancy guard in timer functions CVE-2026-17588 hw/display/vga: fix text-mode OOB write after a graphics surface switch CVE-2026-77913 io/channel-socket: do not treat a zero length...

PT-2026-122584

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122586

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

Gitea 1.27.0 Arbitrary File Read

Gitea version 1.27.0 and prior affected versions contain an arbitrary file read through Org-mode +INCLUDE directives submitted to a public repository markup endpoint. The proof of concept retrieves target files and attempts a chain to command execution. https://packetstorm.news/download/237363...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...