Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues: The following security issues were fixed: CVE-2025-40204: sctp: Fix MAC comparison to be constant-time bsc1253437. CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-23449:...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

PT-2026-87027

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502: Deserialization of Untrusted Data

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-86728: Missing Authentication for Critical Function

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

PT-2026-87125

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server...

CVE-2026-86721: Improper Authentication

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86727: Missing Authentication for Critical Function

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live...

CVE-2026-86718: Cross-Site Request Forgery (CSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

PT-2026-87115

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

CVE-2022-51016 PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay

PocketMine-MP 3.x before 3.27.0 does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session for example by tricking t...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issues: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713. Patch Instruction...

Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate bsc1275145, bsc1274792. CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. CVE-2026-63076: invalid point...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issue: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issues: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712, bsc1271713. Patch Instruction...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issue: CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...