NewStart CGSL MAIN 6.06 : glib2 Multiple Vulnerabilities (NS-SA-2026-0061)

The remote NewStart CGSL host, running version MAIN 6.06, has glib2 packages installed that are affected by multiple vulnerabilities: - filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead,...

HPESBNW05091 rev.1 - HPE Telco Service Activator, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Insecure Deserialization SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Activator =10.6.1 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-54512 |...

NewStart CGSL MAIN 6.06 : cups-filters Multiple Vulnerabilities (NS-SA-2026-0051)

The remote NewStart CGSL host, running version MAIN 6.06, has cups-filters packages installed that are affected by multiple vulnerabilities: - CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to,...

WordPress MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.7.23 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion vulnerability

Insecure Direct Object Reference to Authenticated Instructor+ Arbitrary Attachment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin MasterStudy LMS versions = 3.7.23...

CVE-2026-48058

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-65881

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

CVE-2026-65881 Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

CVE-2026-65881

The Joomdle Joomla extension (versions

CVE-2026-4648

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...

Vatican&#8217;s Click To Pray app exposed personal data from 700,000 users

A prayer app launched by Pope Francis in 2019 contained a security flaw that exposed the personal information of hundreds of thousands of users before it was finally fixed this year. The app, Click To Pray, was developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer...

CVE-2026-65880 Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type...

CVE-2026-65880 Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3

Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type...

CVE-2026-14926

The FluentCart A New Era of eCommerce WordPress plugin, in versions before 1.4.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that a subscription belongs to the requesting customer across several payment-method endpoints . This oversight allows an...

CVE-2026-16797

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement for WordPress (plugin) is affected up to version 3.4.5 by an Insecure Direct Object Reference via the optionSection parameter. The flaw arises from missing validation on a user-controlled key, enabling authenticated attackers with con...

EUVD-2026-49693

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

CVE-2026-16797

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

EUVD-2026-49632

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

PT-2026-65479

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

CVE-2026-65881: Initialization of a Resource with an Insecure Default

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

SUSE SLED15 / SLES15 Security Update : gzip (SUSE-SU-2026:3269-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3269-1 advisory. This update for gzip fixes the following issue: - CVE-2026-41991: insecure temporary file handling in the gzexe utility...