USN-8733-1: Gzip vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...

CVE-2026-86404 Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

CVE-2026-86404

Red Hat EAP 's Artemis messaging component permits deserialization by default due to a misconfiguration in its security filtering. Specifically, ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which applies allow-list/block-list filtering via checkSecurity()/isTrustedType(). Howe...

CVE-2026-86347

MISP is affected by a missing authorization flaw in the TemplatesController::uploadFile() action. The ACL entry for templates/uploadFile used the wildcard * instead of the intended perm_add role restriction, allowing any authenticated user—including low-privileged or read-only users—to repeatedly...

CVE-2026-4945: Authorization Bypass Through User-Controlled Key

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

The vulnerability of the SIMATIC S7 PLC web server, related to insecure resource initialization, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the web server in the SIMATIC S7 PLC is related to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

PT-2026-86920

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

PT-2026-86921

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

The vulnerability of the high-performance operator panels from the SIMATIC HMI Unified Comfort Panels Standard family lies in their unsafe initialization of resources, allowing attackers to gain unauthorized access to the web browser.

The vulnerability of the high-performance operator panels from the SIMATIC HMI Unified Comfort Panels Standard family relates to the insecure initialization of resources. Exploiting this vulnerability could allow an intruder to gain unauthorized access to the web browser...

PT-2026-86765

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view. The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: type key data fingerprint but did n...

CVE-2026-16310: Authorization Bypass Through User-Controlled Key

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

CVE-2026-86111 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

CVE-2026-78150

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

SUSE CVE-2026-53475

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security TLS connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle MITM attacker to intercept and harvest vCenter administrator credentials. This can lead to...

SUSE CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

PT-2026-86333

🚨 CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and...

GHSA-GCX9-497G-6CP6 vulnerabilities

Vulnerabilities for packages: thingsboard...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness through the JWT signing flow in DefaultSecretProvider and JwtServiceImpl under powerjob-server-auth. An attacker can forge HS256-signed JWTs by using the predictable signing key and then send those tokens to the serv...

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1 , its REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser ...

CVE-2026-75166

Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...